Third-party contractor compromise exposed health information and insurance billing passwords