Connecticut’s Health Net lost a computer hard drive and the personal, medical and financial information of roughly 1.5 million members, including 450,000 Connecticut residents, leaving them vulnerable to ID theft, medical ID theft, financial loss, insurance fraud, credit card fraud and public humiliation.

The data breach occurred in May, but Health Net never notified their customers, state officials or law enforcement until last week.

The lost information covers the period from 2002 to the present, and pertains to past and present members from Arizona, New Jersey, New York and Connecticut who

Connecticut Attorney General Richard Blumenthal said he was “outraged and appalled” not just by the data loss, but by Health Net’s keeping the information loss under wraps for six months. Their silence could be a violation of Connecticut law, he said.

A Health Net spokeswoman explained the lengthy interval between the event and their disclosure of it by saying they were performing an internal investigation and detailed forensic review to determine exactly what information was on the stolen hard drive.

The patients’ information was unencrypted though it included their names, Social Security numbers, private health information and bank and credit card account numbers.

“Protecting the privacy of our members is extremely important to us,” the company said in a statement. “We apologize for any inconvenience or concern this may cause our members.”

A Health Net representative said they haven’t received any reports of ID theft because of the data breach.

Health Net experienced a similar data breach last year when a laptop was stolen from a company vendor. The laptop contained the names and Social Security numbers of 5,000 employees and an undisclosed number of health-care providers. In that case Health Net notified their employees of their increased risk of ID theft roughly a month after the laptop was stolen.