Keystone Health data breach: what happened and what to do

Keystone Health, a Pennsylvania primary care provider, reported a 2022 cyberattack that exposed the health information of 235,237 people. Files held names, addresses, dates of birth, Social Security numbers and medical details like diagnoses and medications.

View all 13,177 breaches

Breach date: 28 Jul 2022
Affected: 235,237
Data exposed: Names, Physical addresses, Dates of birth, Social security numbers, Medical information
Last updated: 31 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

Keystone Health (Keystone Rural Health Center) reported to the U.S. Department of Health and Human Services that a cyber incident affected the protected health information of 235,237 people.

What happened

Press coverage of the notice says Keystone found the incident on August 19, 2022 and later determined that an unauthorized party had accessed files on its systems between July 28 and August 19. It notified affected people, the media and HHS, and posted a notice on its website. Reports differ on whether ransomware was involved, and Keystone's notice doesn't say.

Sources checked: securityweek.com, hipaajournal.com, ocrportal.hhs.gov

Last verified against the official page: 31 Oct 2026

How we research this Report an error

What was exposed

HHS's case summary lists names, addresses, dates of birth, Social Security numbers, diagnoses, lab results and medication information. That mix matters. A Social Security number with a date of birth is what criminals need to open credit in your name, and medical details make phishing calls that claim to be from your doctor or insurer more believable.

The response

Per HHS, Keystone offered free credit monitoring and added administrative, technical and security safeguards. HHS's Office for Civil Rights gave technical assistance on the HIPAA rules.

What this means for you

If you were a Keystone patient, you should have received a letter. Use the steps below, starting with a credit freeze.

What to do if you were in it

1

Freeze your credit at all three bureaus

Social Security numbers and dates of birth are enough to open accounts in your name. A credit freeze is free, and you place it separately at Equifax, Experian and TransUnion. The FTC explains how: https://consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
2

Read your insurance statements

Check explanation of benefits statements and medical bills for care you didn't receive. If something looks wrong, call your insurer and the provider.
3

Expect phishing that mentions the breach

Calls, texts and emails that quote real details about you are more convincing. Don't click links or give out information; contact the organization using a number from its own website. The FTC's breach guide is at https://www.identitytheft.gov/databreach
4

Check whether your details are in other breaches

Run a free Serus scan to see whether your email or phone number shows up in this and other breaches. Serus can't remove breach data, but it alerts you when your details appear in new ones.