Get Permission The Department of Health and Human Services has slapped insurer Excellus Health Plan with a $5.1 million settlement in the wake of a 2015 breach that affected more than 9.3 million individuals. Excellus, which serves upstate and western New York, in September 2015 filed a breach report stating that intruders had gained unauthorized access to its information systems, HHS’ Office for Civil Rights says in a statement Friday. The Blue Cross Blue Shield health plan reported that the breach began on or before Dec. 23, 2013, and ended on May 11, 2015. ”The hackers installed malware and conducted reconnaissance activities that ultimately resulted in the impermissible disclosure of the protected health information of more than 9.3 million individuals, including their names, addresses, dates of birth, email addresses, Social Security numbers, bank account information, health plan claims, and clinical treatment information,” OCR says.