21st Century Oncology 21co.com 21st Century Oncology data breach: what happened and what to do
21st Century Oncology, a cancer care provider, said an attacker may have accessed its patient database from October 3, 2015. HHS says 2,213,597 people were affected: names, Social Security numbers, physicians' names, diagnoses, treatment and insurance information.
View all 13,177 breaches- Breach date
- 3 Oct 2015
- Affected
- 2,213,597
- Data exposed
- Names, Social security numbers, Medical information, Treatment information, Health insurance information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
21st Century Oncology (21CO) provides cancer care and radiation oncology and is based in Fort Myers, Florida. In 2015 the FBI told the company twice that patient information had been illegally obtained by an unauthorized third party. The company's own investigation found that the attacker may have accessed its network SQL database as early as October 3, 2015, through remote desktop protocol from an exchange server inside its network.
According to the U.S. Department of Health and Human Services (HHS), 2,213,597 people were affected.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What was exposed
HHS says the data included names, Social Security numbers, physicians' names, diagnoses, treatment and insurance information. A Social Security number can't be changed easily, and diagnosis and treatment details are among the most sensitive records a person has.
The company's response and the settlement
HHS's Office for Civil Rights (OCR) investigated and found that 21CO had not carried out an accurate and thorough risk assessment, had not put sufficient security measures in place, and had shared protected health information with vendors without a written business associate agreement. 21CO agreed to pay $2.3 million and adopt a corrective action plan. In May 2017 the company filed for Chapter 11 bankruptcy protection, and the bankruptcy court approved the OCR settlement in December 2017.
What it means for you
With a name, Social Security number and insurance details, a criminal can try to open credit or file medical claims in your name. Health details also fuel convincing phishing that mentions your treatment.
What to do if you were in it
- 1
Place a free credit freeze
A freeze at Equifax, Experian and TransUnion blocks new accounts opened in your name. It's free, and the FTC explains how credit freezes and fraud alerts work.
- 2
Watch your statements and explanations of benefits
Look for charges, accounts or medical bills you don't recognize, and check your credit reports at annualcreditreport.com.
- 3
Report identity theft right away
If someone misuses your details, report it at IdentityTheft.gov to get a recovery plan.
- 4
Expect phishing that mentions the breach
Don't click links in unexpected messages. The FTC explains how to recognize and avoid phishing.
- 5
Check which other breaches include you
Run a free Serus scan to see which other breaches include your email or phone. Serus monitors breach databases and the dark web and alerts you; it can't remove data from a breach.
Official filings
- U.S. Department of Health and Human Services , filed 4 Mar 2016 : 2,213,597 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the 21st Century Oncology breach?
HHS says 2,213,597 people were affected. If you were a patient around 2015, the company or its successor should have sent a notice letter.
What was exposed?
Names, Social Security numbers, physicians' names, diagnoses, treatment and insurance information, according to HHS.
Is there a settlement?
HHS's Office for Civil Rights settled with 21st Century Oncology for $2.3 million and a corrective action plan. HHS describes this as a regulatory settlement; its announcement doesn't mention payments to patients.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
