# HIPAA Breach Notification Letter Template

**[STELLAR PAYMENTS GROUP HEALTH PLAN LOGO]**

Date: 12 May 2026

Re: Notice of Data Breach Affecting Your Protected Health Information

Dear [Individual Name],

We are writing to notify you of a security incident that may have involved your protected health information (PHI) maintained by the Stellar Payments Group Employee Health Plan.

## What Happened

On 13 March 2026, Stellar Payments Group discovered that an unauthorized third party gained access to systems containing employee health plan records between 10 March and 13 March 2026. The unauthorized access was the result of a targeted phishing attack that compromised an IT administrator's credentials. We immediately contained the incident, engaged a leading cybersecurity firm (Mandiant) to conduct a forensic investigation, and reported the matter to law enforcement.

Our investigation determined that the unauthorized person may have accessed files containing protected health information for approximately 8,420 current and former employees enrolled in the Stellar Payments Group Employee Health Plan.

## What Information Was Involved

The types of information that may have been accessed include:

- Full name
- Date of birth
- Social Security number
- Health plan member ID number
- Claims and enrollment information
- Diagnosis and procedure codes

Your specific records may not have included all of these data types.

## What We Are Doing

Upon discovering this incident, we took the following actions:

- Immediately contained the breach by isolating affected systems and revoking compromised credentials.
- Engaged Mandiant, a leading cybersecurity firm, to conduct a thorough forensic investigation.
- Reported the incident to the U.S. Department of Health and Human Services Office for Civil Rights.
- Notified law enforcement authorities.
- Implemented enhanced security measures including phishing-resistant multi-factor authentication, network segmentation, and enhanced monitoring.

## What You Can Do

We recommend that you take the following steps to protect yourself:

1. **Enroll in free credit monitoring and identity protection**: We are offering 24 months of complimentary identity protection services through Experian IdentityWorks, including credit monitoring, dark web surveillance, identity theft insurance up to $1 million, and identity restoration services. To enroll:
   - Visit: experianidworks.com/stellar
   - Enrollment code: [UNIQUE CODE]
   - Enrollment deadline: 12 August 2026

2. **Place a fraud alert**: Contact one of the three major credit bureaus to place a free fraud alert on your credit file:
   - Equifax: 1-800-525-6285 / equifax.com
   - Experian: 1-888-397-3742 / experian.com
   - TransUnion: 1-800-680-7289 / transunion.com

3. **Request a free credit report**: Under federal law, you are entitled to one free credit report per year from each of the three bureaus at annualcreditreport.com or by calling 1-877-322-8228.

4. **Monitor your Explanation of Benefits**: Review all Explanation of Benefits (EOB) statements from your health insurer for services you did not receive. Report discrepancies to your health plan immediately.

5. **Consider a credit freeze**: You may place a free credit freeze on your credit file to prevent new accounts from being opened in your name. Contact each of the three credit bureaus above.

6. **Report identity theft**: If you believe you are a victim of identity theft, file a report with the Federal Trade Commission at identitytheft.gov or call 1-877-438-4338. You may also file a police report with your local law enforcement.

## For More Information

If you have questions about this incident, please contact our dedicated breach response team:

- **Toll-free phone**: 1-888-555-0199 (Monday-Friday, 8:00 AM - 8:00 PM ET)
- **Email**: phi-breach@stellarpayments.com
- **Mail**: Stellar Payments Group, HIPAA Breach Response Team, Friedrichstraße 191, 10117 Berlin, Germany / 1200 17th Street NW, Suite 500, Washington, DC 20036, USA

Our Privacy Officer, Dr. Elena Vasquez, can be reached at privacy@stellarpayments.com or +1 (202) 555-0142.

We sincerely regret this incident and are committed to protecting the privacy and security of your health information.

Sincerely,

Marcus Lindqvist
Chief Executive Officer
Stellar Payments Group