The Cabinet for Health and Family Services (CHFS) is sharing information on a security breach involving Gainwell Technologies, a vendor contracted with the Kentucky Department for Medicaid Services’ Ky Health-Net information system.

On Aug. 18, 2026, a health care provider notified Gainwell that an unauthorized third party had gained access to some provider payment accounts on the KY Health-Net Provider Portal and downloaded files containing Kentucky Medicaid member information. This unauthorized access occurred on March 26, April 16 and April 21.

Immediate action took place upon discovery and steps were taken to secure the information portal. Law enforcement was notified and a thorough investigation was completed. It is believed the unauthorized caller was seeking access to provider payment information rather than patient information: However, an estimated 3,816 individuals are believed to be impacted by this incident.

While the impacted information varied by individual, this incident involved the disclosure of full names; identification numbers associated with the providers account or Medicaid claims; dates of medical services; information about services received and how they were billed; payment information, including amounts paid; and information about applicable non-Medicaid health insurance, including policy and group numbers.

The unauthorized third party did not gain access to electronic health records, Social Security Numbers, or financial account information. While CHFS has not yet received reports of any misuse of personal information or harm to KY Health-Net members as a result of this incident, potentially impacted individuals are encouraged to remain vigilant.