Names, health insurance information, and SSNs were all exposed in a breach which lasted for more than two months.