Advocate Medical Group advocatehealth.com Advocate Medical Group data breach: what happened and what to do
In July 2013, computers were stolen from an Advocate Medical Group office in the Chicago area. News reports put the number of patients at about 4 million. Names, addresses, dates of birth and Social Security numbers were reported among the data on the machines.
View all 13,177 breaches- Breach date
- 15 Jul 2013
- Made public
- 23 Aug 2013
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Advocate Medical Group, part of the Chicago-area health system Advocate Health Care, reported a data breach in 2013. Computers were stolen from an administrative office in July 2013, and news coverage said they held records on about 4 million patients.
What was exposed
Reports on the breach said the records included patient names, addresses and dates of birth. Social Security numbers were reported too, along with clinical details such as treating physicians or departments, diagnoses, medical record numbers and insurance data. Advocate offered affected patients free credit monitoring and identity theft protection.
What it means for you
A name, a date of birth and a Social Security number together are what a criminal needs to open credit in your name. Medical details can also be used in scams that quote a real doctor or diagnosis. If you were a patient and got a letter, take the offer of credit monitoring and read it as a warning, not a formality.
What happened next
Patients sued in Cook County in September 2013. In August 2016, the U.S. Department of Health and Human Services announced a $5.55 million settlement with Advocate Health Care Network over several breaches it had reported, covering about 4 million people in total. HHS said Advocate failed to run an adequate risk assessment and had left an unencrypted laptop in an unlocked vehicle overnight.
Sources checked: hcinnovationgroup.com, medcitynews.com, privacyrights.org
Last verified against the official page:
What to do if you were in it
- 1
Freeze your credit
Place a free credit freeze at Equifax, Experian and TransUnion, separately at each one, as the FTC explains. It blocks most new accounts in your name and you can lift it when you need credit. Do it now if your Social Security number was in the letter.
- 2
Take the credit monitoring and watch your reports
If you got an offer of free credit monitoring, the FTC recommends taking it. Check your reports for accounts you don't recognize at annualcreditreport.com.
- 3
Read your insurance statements
Look at the explanation of benefits your insurer sends and question any treatment you didn't get. That is how medical identity theft shows up.
- 4
Expect scams that mention your care
Be wary of calls, texts and emails that quote a doctor, a diagnosis or a bill. Contact the provider using a number you look up yourself.
- 5
Check whether your details are in other breaches
Run a free Serus scan to see whether your email or phone number shows up in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your data appears; it can't remove data from a breach.
Official filings
- California Attorney General , filed 23 Aug 2013
Timeline
-
The breach happened
-
The company made it public
-
Reported to the California Attorney General
Frequently asked
Was I affected by the Advocate Medical Group breach?
Advocate notified patients by letter after the July 2013 theft. If you were treated at an Advocate Medical Group office around then and got no letter, contact Advocate to ask.
What was exposed?
News reports listed names, addresses, dates of birth and Social Security numbers, plus clinical and insurance details.
Was there a settlement?
Patients filed a class action in Cook County in 2013. Separately, HHS announced a $5.55 million settlement with Advocate Health Care Network in August 2016 over several breaches, including this one.
Should I freeze my credit?
If your Social Security number was exposed, yes. A freeze is free and the FTC recommends it as a way to block new accounts.
Sources
- hcinnovationgroup.com/cybersecurity/privacy-security/news/13021897/data-breach-at-medical-group-impacts-43-million-patients
- medcitynews.com/2016/08/advocate-hipaa-settlement/
- privacyrights.org/data-breaches/advocate-health-and-hospitals-corporation-dba-advocate-medical-group
- oag.ca.gov/privacy/databreach/list
Something wrong or out of date? Tell us and we'll re-check it.
