Goodman Campbell Brain and Spine goodmancampbell.com Goodman Campbell Brain and Spine data breach: what happened and what to do
Goodman Campbell Brain and Spine, an Indiana neurosurgery practice, found a ransomware attack on May 20, 2022. It told HHS the health information of 362,833 people was involved, including Social Security numbers, driver's license numbers, diagnoses and medications.
View all 13,177 breaches- Breach date
- 20 May 2022
- Affected
- 362,833
- Data exposed
- Names, Physical addresses, Dates of birth, Driver's licenses, Social security numbers, Claims information, Diagnoses, Medical information, Lab results, Medications
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Goodman Campbell Brain and Spine, a neurosurgery practice in Carmel, Indiana, discovered on May 20, 2022 that its computer network had been compromised in a ransomware attack. It reported to the U.S. Department of Health and Human Services that the protected health information of 362,833 people was affected. Health IT Security reported that some patient data was later posted on the dark web, where it stayed available for about 10 days.
Sources checked: ocrportal.hhs.gov, healthitsecurity.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
Per the HHS entry, the data included names, addresses, dates of birth, driver's license and Social Security numbers, claims information, diagnoses, conditions, lab results and medications. The identity details can be used to open credit or file fake claims in your name. The medical details make phishing more convincing, because a message that mentions your real condition or medication looks legitimate.
Why health data leaks matter
Unlike a password, a diagnosis or a medication list can't be changed. Criminals can keep using it for months or years, for example to write messages that sound like they come from your doctor. That is why the steps below focus on locking down your credit and watching your medical statements.
The company's response
The practice notified HHS, affected individuals and the media, and posted a substitute notice. It offered 12 months of free credit and identity monitoring, notified the FBI and added administrative, technical and security safeguards.
What to do if you were in it
- 1
Use the free credit monitoring if you got a letter
Enroll using the instructions in your notice. The FTC recommends taking credit monitoring a company offers after a breach.
- 2
Freeze your credit
A credit freeze is free and stops lenders from seeing your report, which blocks most new accounts in your name. Place it separately at Equifax, Experian and TransUnion. Lift it when you apply for credit yourself.
- 3
Read your explanation of benefits statements
Question any treatment, claim or provider you don't recognize with your insurer, and report it as possible medical identity theft.
- 4
Expect scams that mention your health
Don't click links or give details in unexpected calls, emails or texts, even if they name your doctor or condition. Call the practice or insurer on a number you look up yourself.
- 5
Report misuse
If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
- 6
Check what else is out there
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your details show up. It can't remove breach data, so the steps above are what protect you.
Official filings
- U.S. Department of Health and Human Services , filed 19 Jul 2022 : 362,833 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Goodman Campbell breach?
The practice notified affected patients by mail. If you were a patient and didn't get a letter, contact the practice to ask whether your records were involved.
What was exposed?
According to HHS, names, addresses, dates of birth, driver's license and Social Security numbers, claims information, diagnoses, conditions, lab results and medications.
Should I freeze my credit?
Yes, if your Social Security number or driver's license number was involved. A freeze is free and you can lift it any time.
Can the leaked data be taken down?
No. Once data has been posted by criminals, copies can circulate for years. You protect yourself by making it less useful: a credit freeze, careful reading of your statements and caution with messages about your health.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
