Fraser fraser.org Fraser data breach: what happened and what to do
Fraser, a Minnesota provider of autism and mental health services, said an employee email account was phished in August 2019. HHS lists 2,890 people affected. Names, addresses and treatment information were involved.
View all 13,177 breaches- Breach date
- 6 Aug 2019
- Made public
- 30 Aug 2019
- Affected
- 2,890
- Data exposed
- Names, Physical addresses, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Fraser, a Minnesota provider of autism and early childhood mental health services, told HHS that an employee was the victim of an email phishing scheme. HIPAA Journal reports the attack on the account happened on August 6, 2019 and that staff secured the account within hours. HHS lists 2,890 people affected.
Sources checked: ocrportal.hhs.gov, hipaajournal.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
HHS says the information included names, addresses and treatment information. A HIPAA Journal report says Social Security numbers and credit card information were not involved.
What that means for you
This kind of data fits targeted phishing: a message that mentions a child's care or a waitlist looks real. It doesn't include the identifiers needed to open credit, but it is private.
What to watch for
The FTC says to treat unexpected messages about a breach with care, because scammers often pose as the organization involved. If a letter from Fraser reaches you, check it against the contact details on the organization's own website before you call any number printed in a message.
What Fraser did
HHS reports that Fraser notified HHS, affected people and the media, set up a toll-free information line, offered credit monitoring and identity theft protection, added safeguards and trained all employees to spot fraudulent email.
What to do if you were in it
- 1
Be careful with messages that mention Fraser or your care
Don't click links or open attachments in unexpected messages. Contact Fraser using a number you already trust.
- 2
Use the services Fraser offered
If you received a letter, it explains the credit monitoring and how to use the information line.
- 3
Know where to report misuse
If someone uses your details, report it at IdentityTheft.gov.
- 4
Check whether your email or phone is in this and other breaches
A free Serus scan checks breach databases for your email and phone and shows what else is out there.
Official filings
- U.S. Department of Health and Human Services , filed 30 Aug 2019 : 2,890 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
How many people were affected?
HHS lists 2,890 people.
Were Social Security numbers exposed?
HHS's description lists names, addresses and treatment information. A HIPAA Journal report says Social Security numbers weren't revealed.
Should I freeze my credit?
The reports don't list a Social Security number, so it isn't required. The FTC says a freeze is free if you want one: https://consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
Sources
Something wrong or out of date? Tell us and we'll re-check it.
