CodeMetro codemetro.com CodeMetro data breach: what happened and what to do
CodeMetro, a company that handles records for healthcare providers, reported a cyber-attack that began on April 21, 2020. HHS lists about 62,807 people. Exposed data included names, Social Security numbers, addresses, dates of birth, diagnoses, health insurance and claims information.
View all 13,177 breaches- Breach date
- 21 Apr 2020
- Affected
- 62,807
- Data exposed
- Names, Social security numbers, Physical addresses, Dates of birth, Diagnoses, Health insurance information, Claims information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
On April 21, 2020, CodeMetro systems were hit by ransomware. A sample notice letter filed with the California Attorney General says the attackers got into a database server first and used tools to copy and remove some data before they deployed the ransomware. CodeMetro told the healthcare providers it works with by letter dated May 29, 2020, and the providers then notified patients.
CodeMetro reported the incident to the US Department of Health and Human Services (HHS), which lists about 62,807 people affected.
Sources checked: oag.ca.gov, ocrportal.hhs.gov, consumer.ftc.gov
Last verified against the official page:
What was exposed
HHS's case description says the information included names, Social Security numbers, addresses, dates of birth, diagnoses and conditions, health insurance information and claims information. The California notice also mentions school and special-education details in some letters.
What that means for you
A Social Security number plus a date of birth and address is what someone needs to open credit in your name or file a fake tax return, and that can happen months or years after a breach. Diagnosis and claims details can fuel convincing phishing that pretends to come from your provider or insurer, or false insurance claims.
What the company did
According to HHS, CodeMetro retrained its workforce and added technical safeguards after the federal investigation. Letters sent to some people offered credit monitoring at no cost where a Social Security number may have been accessed.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A credit freeze is free and stops lenders from seeing your credit report, which blocks most new accounts in your name. Place it separately at Equifax, Experian and TransUnion, as the FTC explains. Then check your reports at annualcreditreport.com.
- 2
Read your insurance statements
Check the explanation of benefits your insurer sends and question any treatment or claim you don't recognize. Call the insurer if something doesn't match.
- 3
Take the free credit monitoring if you were offered it
The notice letter says it was offered where a Social Security number may have been accessed. Monitoring alerts you to new activity, so pair it with a freeze.
- 4
Treat messages that mention the breach as suspect
Scammers quote real breach details to look legitimate. Don't click links or call numbers in unexpected messages. Go to the company's website yourself, and see the FTC's phishing guide.
- 5
Report misuse at IdentityTheft.gov
If someone opens an account or files a return in your name, report it at IdentityTheft.gov and follow the recovery plan it gives you.
Official filings
- U.S. Department of Health and Human Services , filed 19 Jun 2020 : 62,807 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the CodeMetro breach?
If CodeMetro or your healthcare provider sent you a notice letter, yes. Providers were told first and then wrote to patients. If you think you should have received one, ask your provider.
What was exposed in the CodeMetro breach?
HHS lists names, Social Security numbers, addresses, dates of birth, diagnoses and conditions, health insurance information and claims information.
How many people were affected?
HHS lists about 62,807 individuals.
Should I freeze my credit?
If you got a notice that your Social Security number may have been accessed, yes. A freeze is free and the FTC recommends it as a way to block new accounts.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
