Episcopal Health Services ehs.org Episcopal Health Services data breach: what happened and what to do
Episcopal Health Services, which runs St. John's Episcopal Hospital in New York, reported that a phishing scheme affected 218,055 people. Exposed data included names, birth dates, Social Security and driver's license numbers, financial details and treatment information.
View all 13,177 breaches- Breach date
- 28 Aug 2018
- Made public
- 19 Nov 2018
- Affected
- 218,055
- Data exposed
- Names, Dates of birth, Physical addresses, Social security numbers, Driver's licenses, Financial information, Diagnoses, Medications, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Episcopal Health Services, Inc. told the U.S. Department of Health and Human Services (HHS) that numerous employees fell for an email phishing scheme. HHS lists 218,055 people as affected. According to HIPAA Journal, suspicious activity in several employee email accounts was detected in September 2018, and the accounts were accessed between 28 August and 5 October 2018.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What was exposed
HHS says the information included names, dates of birth, addresses, Social Security numbers, driver's license numbers, financial information, diagnoses, medications prescribed and other treatment information. What leaked differed from patient to patient.
The organization notified HHS, affected individuals and the media, and offered free credit monitoring. It put in new administrative and technical safeguards, and HHS obtained assurances that corrective actions were in place.
Why it matters
Social Security numbers and birth dates are the core of identity theft. Medication and diagnosis details can be used in convincing scams that pose as a pharmacy, insurer or clinic.
If you got a notice letter, use the monitoring it offers and freeze your credit.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A credit freeze stops lenders from seeing your report, which blocks most new accounts opened in your name. The FTC says it's free, lasts until you lift it, and you place it separately at Equifax, Experian and TransUnion. Lift it only when you apply for credit yourself.
- 2
Read your statements and insurance explanations of benefits
Look for charges, accounts or treatment you don't recognize. If something is wrong, report it at IdentityTheft.gov, the FTC's reporting site, which also builds a recovery plan for you.
- 3
Take the offered credit monitoring
If your notice letter included free credit monitoring, the FTC recommends using it. Sign up through the instructions in the letter.
- 4
Expect phishing that mentions the breach
Scammers use real details to sound legitimate. The FTC advises you not to click links or call numbers in unexpected messages; contact the organization using a number from its official website instead.
- 5
Check whether your email or phone is in this and other breaches
Serus runs a free scan against breach databases and the dark web and alerts you if your email or phone number shows up. Serus can't remove data from a breach, but it tells you when to change a password or watch for phishing.
Official filings
- U.S. Department of Health and Human Services , filed 19 Nov 2018 : 218,055 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
How many people were affected?
HHS lists 218,055 individuals.
What was exposed?
Per HHS: names, dates of birth, addresses, Social Security numbers, driver's license numbers, financial information, diagnoses, medications and other treatment information.
Was credit monitoring offered?
Yes. HHS's description says free credit monitoring was provided to affected individuals.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
