Circles of Care circlesofcare.org Circles of Care data breach: what happened and what to do
Circles of Care, a Florida behavioral health provider, told HHS on January 3, 2023 that a ransomware attack exposed the health information of 61,170 people. HHS says it included names, addresses, dates of birth, diagnoses, claims information and Social Security numbers.
View all 13,177 breaches- Breach date
- 6 Sept 2022
- Made public
- 3 Jan 2023
- Affected
- 61,170
- Data exposed
- Names, Dates of birth, Physical addresses, Diagnoses, Claims information, Social security numbers, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Circles of Care, a behavioral health provider in Florida, reported to the U.S. Department of Health and Human Services (HHS) on January 3, 2023 that a ransomware attack compromised the protected health information of 61,170 people. HHS's breach portal lists the cause as a hacking or IT incident.
Press coverage places the attack in the fall of 2022. Sources disagree on the exact date, so we don't give one here. The ransomware group known as AlphV or BlackCat listed the organization on its leak site in October 2022, according to DataBreaches.net.
Circles of Care notified HHS, the people affected and the media. HHS's summary says it added administrative and technical safeguards and retrained its staff afterwards.
Sources checked: ocrportal.hhs.gov, databreaches.net, consumer.ftc.gov
Last verified against the official page:
What was exposed
Per HHS, the information involved included names, dates of birth, addresses, diagnoses, claims information, Social Security numbers and other treatment information.
That mix matters. A Social Security number with a name and date of birth is what criminals need to open credit in your name or file a fake tax return, sometimes months later. Diagnosis and treatment details are sensitive in a different way: scammers can quote them in phone calls or letters that pretend to come from a provider or insurer.
What to do
The FTC recommends checking your credit reports and placing a credit freeze if your Social Security number was exposed. Read any explanation of benefits your insurer sends and question treatment you didn't receive.
What to do if you were in it
- 1
Freeze your credit
If you got a notice, your Social Security number may be among the data. Per the FTC, a credit freeze is free and you place it separately at Equifax, Experian and TransUnion.
- 2
Read your medical and insurance statements
Check explanation of benefits statements for services you didn't receive and report anything odd to your insurer.
- 3
Expect calls, texts and letters that mention your care
Don't share details with an unexpected caller. Contact the provider or insurer using a number from their official site.
- 4
Check your credit reports
You can get your free reports at AnnualCreditReport.com, the site the FTC points to, and look for accounts you don't recognize.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you if your data appears.
Frequently asked
Was I affected by the Circles of Care breach?
HHS says 61,170 people were affected. Affected people were notified by the organization. If you were a patient and didn't get a notice, ask Circles of Care directly.
What was exposed?
HHS lists names, dates of birth, addresses, diagnoses, claims information, Social Security numbers and other treatment information.
Should I freeze my credit?
If your Social Security number may have been exposed, the FTC says a freeze is a free way to block new credit in your name.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
