Fertility Centers of Illinois fcionline.com

Fertility Centers of Illinois data breach: what happened and what to do

Fertility Centers of Illinois reported an attack affecting 79,943 people, with suspicious activity spotted on February 1, 2021. HHS lists names, addresses, dates of birth, driver's license and Social Security numbers, financial details, diagnoses and treatment information.

View all 13,177 breaches
Breach date
Feb 2021
Made public
27 Dec 2021
Affected
79,943
Data exposed
Names, Physical addresses, Dates of birth, Driver's licenses, Social security numbers, Treatment information
Last updated

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

Fertility Centers of Illinois (FCI) reported to HHS in December 2021 that 79,943 people were affected by a cyberattack. According to reporting on the incident, FCI saw suspicious activity on its network on February 1, 2021, and brought in outside forensic specialists. An intruder got into administrative files and folders. The electronic medical record system was not reached.

HHS's summary describes the incident as a ransomware attack. News coverage of the filing describes a cyberattack on administrative files, so the sources differ on that label.

Sources checked: infosecurity-magazine.com, hipaajournal.com, ocrportal.hhs.gov

Last verified against the official page:

How we research this Report an error

What was exposed

HHS lists names, addresses, dates of birth, driver's license and Social Security numbers, claims and financial information, diagnoses and conditions, lab results, medication information and other treatment information. Employee data was also involved.

What it means for you

Driver's license and Social Security numbers plus a date of birth are what identity thieves need to open accounts or file for refunds in your name. Financial details can feed payment fraud, and treatment information makes phishing that mentions your clinic more convincing.

The company's response

FCI notified HHS, affected people and the media. It offered complimentary credit monitoring and added administrative, technical and security safeguards. HHS's Office for Civil Rights provided technical assistance. A proposed $450,000 settlement later resolved a lawsuit that alleged delayed notification; FCI did not admit wrongdoing.

What to do if you were in it

  1. 1

    Freeze your credit at all three bureaus

    A Social Security number is in the exposed data, so a freeze is the strongest step. Per the FTC, a freeze is free, lasts until you lift it, and you place it separately at Equifax, Experian and TransUnion. You can also place a free fraud alert, which tells lenders to verify your identity first.

  2. 2

    Watch your statements and credit reports

    Check bank, card and insurer statements for charges or claims you don't recognize. The FTC's breach guidance walks through reporting identity theft if it happens.

  3. 3

    Read your insurer's explanation of benefits

    Look for treatments, providers or claims you don't recognize. If you see one, tell your insurer and ask what it requires to flag the account. The FTC lists medical identity theft among the reasons to report to IdentityTheft.gov.

  4. 4

    Check whether your email or phone is in this and other breaches

    Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details appear. It can't remove data that has already leaked, so the steps above still matter.

Official filings

Timeline

  1. The breach happened

  2. The company made it public

  3. Reported to U.S. Department of Health and Human Services

Frequently asked

Was I affected by the Fertility Centers of Illinois breach?

If you received a notice from FCI, yes. Current and former patients were among the 79,943 people reported to HHS.

What was exposed?

HHS lists names, addresses, dates of birth, driver's license and Social Security numbers, financial information, diagnoses, lab results and treatment information.

Is there a settlement?

Reporting by HIPAA Journal describes a proposed $450,000 settlement of a lawsuit over the breach. Check the court record for current terms.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Serus

Check if you're exposed in a breach with Serus

Find your leaks. Get alerted to new ones.

Run a free scan

Related guides

All guides
How to opt out of prescreened credit card offers (OptOutPrescreen) optoutprescreen.com How to stop junk mail dmachoice.org Remove yourself from Equifax equifax.com Remove yourself from Experian experian.com

Related articles

All articles

How to Get My Information Off the Dark Web

What is the dark web? Definition and how it works

What Happens If Your Email Is on the Dark Web – And What to Do Next

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.