Clinivate clinivate.com Clinivate data breach: what happened and what to do
Clinivate, a health care technology company, reported a ransomware attack that started in March 2022 and affected 77,652 people. Names, addresses, dates of birth, driver's license and Social Security numbers, and medical details were involved.
View all 13,177 breaches- Breach date
- 12 Mar 2022
- Made public
- 2 Jun 2022
- Affected
- 77,652
- Data exposed
- Names, Physical addresses, Dates of birth, Driver's licenses, Social security numbers, Claims information, Diagnoses, Lab results, Medications, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Clinivate, LLC works with health care providers as a business associate, so patients often never dealt with it directly. It told the U.S. Department of Health and Human Services (HHS) that it was hit by a ransomware attack that affected the health information of 77,652 people. It also filed a notice with the California Attorney General in June 2022. Clinivate says the intrusion began on March 12, 2022. Coverage of the notice letters says Clinivate also informed the FBI and offered identity monitoring.
Sources checked: ocrportal.hhs.gov, oag.ca.gov, itpro.com
Last verified against the official page:
What was exposed
HHS lists names, addresses, dates of birth, driver's license numbers and Social Security numbers, plus claims information, diagnoses, lab results, medications and other treatment information.
The mix matters. A Social Security number and date of birth together are what criminals need to open credit or file a tax return in your name. Medical details can be used to make phishing messages and scam calls sound believable, for example a caller who knows your pharmacy or condition.
What Clinivate did
According to HHS, Clinivate notified affected people, HHS and the media. It added technical safeguards, offered complimentary credit monitoring and retrained its employees. HHS's Office for Civil Rights gave Clinivate technical assistance on the HIPAA rules.
What to do if you were in it
- 1
Read your notice letter and use the free monitoring
If you got a letter from Clinivate or your provider, it explains how to enroll in the credit monitoring on offer. The FTC recommends taking it.
- 2
Freeze your credit
Because Social Security numbers and driver's license numbers were involved, place a free credit freeze at Equifax, Experian and TransUnion. The FTC explains how.
- 3
Check your medical statements
Read the explanation of benefits your insurer sends and question any treatment you didn't receive.
- 4
Treat unexpected calls and messages with suspicion
Expect scams that quote real health details. Don't click links or give details to someone who contacts you; call the provider on a number you look up yourself.
- 5
Report misuse
If someone uses your identity, report it at IdentityTheft.gov to get a recovery plan. To see which other breaches include your email or phone, run a free Serus scan.
Official filings
- U.S. Department of Health and Human Services , filed 2 Jun 2022 : 77,652 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Clinivate data breach?
Clinivate says it notified the people involved. If you received a letter, you were affected. If you think you should have, ask your provider whether it works with Clinivate.
What was exposed in the Clinivate breach?
HHS lists names, addresses, dates of birth, driver's license and Social Security numbers, claims information, diagnoses, lab results, medications and other treatment information.
Should I freeze my credit after the Clinivate breach?
Yes, it's a sensible step when Social Security numbers were involved. A freeze is free and you can lift it whenever you apply for credit.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- oag.ca.gov/privacy/databreach/list
- itpro.com/security/data-breaches/368648/clinivate-notifies-customers-of-data-breach
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
