Gainwell Vendor Breach Exposes Kentucky Medicaid Data for 3,816 People
Kentucky's Cabinet for Health and Family Services disclosed that vendor Gainwell Technologies suffered security breaches on March 26, April 16 and April 21, 2026, discovered by the state in August. An unauthorized third party accessed provider payment accounts on the KY Health-Net Provider Portal and downloaded files containing Medicaid member information for an estimated 3,816 individuals. Exposed data may include full names, provider or claims identification numbers, service dates, billing details, payment amounts and non-Medicaid insurance information, but not Social Security numbers, financial accounts or electronic health records. The cabinet began notifying affected individuals October 16, and Gainwell, which holds a nearly $34 million two-year state contract, has implemented additional staff training and security enhancements.