A data breach that earlier this year hit almost 2 million current and former Health Net Inc. subscribers -- including many in Kern County -- was more serious than originally thought.
The Woodland Hills-based HMO acknowledged Wednesday that it recently sent letters notifying people that their Social Security numbers were compromised, despite the company's individual assurances last spring that only their health information and less sensitive data such as names and addresses may have fallen into the wrong hands.
Health Net spokesman Brad Kieffer also said in an email that the company recently reached out to people who had not been notified that they were affected by the breach.
In the letters to current and former subscribers, the HMO blamed its earlier misstatements on a data analysis error. "We sincerely apologize for this mistake," the letters state.
The publicly traded company declined Wednesday to say how many additional people have been affected by the breach; it did the same when the breach was initially disclosed on March 14.
In March, the state Department of Managed Health Care pegged the number of affected subscribers at 1.9 million. A spokeswoman for the department could not be reached for comment Wednesday.
The breach was caused by the loss of several hard drives from a data center in the Sacramento suburb of Rancho Cordova.
Health Net said its investigation continues and that it has no indication that any information on the hard drives has been used to commit identity theft.
People whose information was on the missing hard drives are being offered two years of credit monitoring services, fraud resolution and credit restoration, among other services. Debix Identity Protection Network is providing these services for Health Net; the phone number to call is 855-434-8074.
It is not uncommon for companies that have experienced a data breach to expand their estimate of customers affected, said Karen Barney, communications coordinator at Identity Theft Resource Center, a San Diego-based nonprofit that provides assistance to victims of identify theft.
"The investigative process is just that," she said. "It's a process."