HEALTHEQUITY, INC.

A business partner's personal-use device carried the malware, and the account it compromised reached straight into a SharePoint repository holding data on about 4.3 million people: Social Security numbers, diagnoses, prescriptions. The vendor's laptop sat inside the trust boundary, and the member records sat in a shared drive rather than a guarded system. That access ran from March to late June before anyone noticed, which is less a break-in than a tenancy.