CorVel Corporation, a third party administrator with offices around the nation, including one in Metairie, suffered a security issue that began on July 21st. The nature and extent of the problem was not immediately clear last week, as CorVel’s email communications and customer-facing services were temporarily nonfunctional.
Notices were not posted on the CorVel website either, leaving some commentators in the workers’ comp industry to speculate about cybersecurity across an industry which handles claims files loaded with personal information.
Louisiana Comp Blog reached out to CorVel with questions about the character and extent of the issue. Melissa Storan, Director of Marketing at CorVel, responded with the following statement yesterday:
“Last week, CorVel experienced a ransomware event that forced us to take a number of systems offline. We are pleased to report that our business systems are reaching full capacity and communications methods have been fully restored.
The forensic investigation to date has not uncovered information indicating that any data was exfiltrated or impacted other than having been encrypted. Though our ability to process claims and communicate with customers through traditional channels was briefly affected, our teams have worked around the clock to clear those backlogs and ensure we are able to provide the level of service our customers are accustomed to.”
It is unclear at this time whether CorVel will face state-level penalties for the backlogged delays in claims processing.
In a press release issued July 31st discussing the company’s Q2 2019 revenue and earnings, CorVel finally acknowledged the event in detail, explaining it as a “security incident” and offering the following:
“While we anticipate that any such costs and delays would likely be incurred during our September quarter and would primarily impact the short and intermediate term, there can be no assurance of the ultimate impact of this attack on our business, results of the operations or financial condition. However, we do not believe, at this time, that this incident will have a long-term material adverse impact on our business, results of operations or financial condition.”
Image Credit: CorVel