Credit: scyther5/Thinkstock
Health savings account providers are discovering that their clients' assets are magnets for crooks — even when the HSA providers' own data defenses are strong.
HealthEquity is seeing more cyber threats from bad actors using sophisticated technology, Scott Cutler, the company's chief executive officer, said Tuesday, during a conference call with securities analysts.
Recommended For You
Some of the bad actors have support from national governments, Cutler added.
For an HSA services provider like HealthEquity, that means even more efforts to improve internal data security programs.
For employers with HSA programs and for the employees with the HSAs, the need to strengthen defenses will lead to even more efforts to educate the HSA holders about ways to create strong passwords and keep crooks from tricking them into revealing information that could let crooks into the HSAs.
HealthEquity may also "introduce even more efforts associated with multi-factor authentication," Cutler said.
Multi-factor authentication systems, or MFA systems, are the systems that require computer users both to provide a password and to look in a digital camera, respond to a cell phone text or supply a code transmitted in an email message to get into an account.
Tougher MFA defenses could increase the number of employers and HSA-owning employees who need
help with HSA lockout problems.
The backdrop: In most ways, this is a great time for HSA providers.
HSA industry assets increased 18% between mid-2023 and mid-2024, to $137 billion in 38 million accounts, according to Devenir.
Some of the top health policy advisors in the administration of President Donald Trump are people who see expanding use of HSAs or similar types of health accounts as a good solution for many health policy problems.
Data security continues to be one nagging source of anxiety.
The threats include attackers trying to get into the HSA providers' systems, attackers trying to get into service providers' systems, and attackers using the personal information available as the result of earlier, unrelated attacks to worm their way into HSA users' accounts.
HealthEquity came face to face with the problem about a year ago, when it discovered that attackers had gotten into a business partner's user account. The breach at an outside entity may have given the attackers access to the personal information of about 4.3 million HSA users.
Related: HealthEquity breach may have affected 4.3M people
Health Equity reported in an annual report filed with securities regulators that it's still dealing with litigation stemming from the attack on the business partner's account.
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
Allison Bell
Allison Bell, a senior reporter at ThinkAdvisor and BenefitsPRO, previously was an associate editor at National Underwriter Life & Health. She has a bachelor's degree in economics from Washington University in St. Louis and a master's degree in journalism from the Medill School of Journalism at Northwestern University. She can be reached through X at @Think_Allison.
