Lamoille Health Partners lamoillehealth.org Lamoille Health Partners data breach: what happened and what to do
Lamoille Health Partners reported a ransomware incident affecting the protected health information of 59,381 people. HHS says it included names, Social Security numbers, addresses, dates of birth, medications, diagnoses and lab results.
View all 13,177 breaches- Breach date
- Jun 2022
- Made public
- 11 Aug 2022
- Affected
- 59,381
- Data exposed
- Names, Social security numbers, Physical addresses, Dates of birth, Medical information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Lamoille Health Partners, a community health provider in Vermont, reported a ransomware incident to the U.S. Department of Health and Human Services (HHS) in August 2022. The HHS breach portal lists 59,381 individuals affected.
What was exposed
According to HHS's case description, the protected health information involved included names, Social Security numbers, addresses, dates of birth, medications, diagnoses and lab results. Medical details plus a Social Security number and date of birth are a risky mix. The first can be used to craft convincing phishing messages that mention real conditions or prescriptions. The second can be used to open credit or file false tax returns in your name.
What the organization did
Lamoille Health Partners notified HHS, the people affected and the media, and posted a substitute notice on its website. HHS says it also implemented additional administrative, technical and security safeguards in response.
What it means for you
If you were a patient and got a letter, assume the Social Security number and date of birth are in criminal hands and act on identity theft first. Be wary of calls, texts or emails that mention your care, a prescription or a lab result and ask for payment or a login. Your provider will not ask you to confirm medical details through a link in a message.
HHS's description doesn't say when the attack started or who carried it out, and this page doesn't guess at either.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What to do if you were in it
- 1
Freeze your credit
Place a free credit freeze at Equifax, Experian and TransUnion, because Social Security numbers and dates of birth were involved. The FTC explains the steps: https://consumer.ftc.gov/articles/what-know-about-credit-freezes-fraud-alerts
- 2
Read your health insurance statements
Check explanation of benefits statements for care you didn't receive. If something looks wrong, call your insurer and the provider's billing office.
- 3
Be suspicious of messages about your care
Expect phishing or scam calls that mention your health. Don't click links or share details; contact the provider using a number from its own website. The FTC's guide: https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams
- 4
Report identity theft
If someone opens an account or files taxes in your name, report it at https://www.identitytheft.gov and follow the plan.
- 5
Check whether your email or phone number shows up in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data appears, so you know what to watch for.
Official filings
- U.S. Department of Health and Human Services , filed 11 Aug 2022 : 59,381 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Lamoille Health Partners breach?
The HHS portal lists 59,381 people. The organization notified affected individuals by mail, so look for a letter, and call the organization if you think you were a patient and didn't get one.
What information was involved?
Names, Social Security numbers, addresses, dates of birth, medications, diagnoses and lab results, per HHS's case description.
Was it ransomware?
Yes. HHS records the incident as a ransomware incident reported by Lamoille Health Partners.
Should I freeze my credit?
Because Social Security numbers were involved, a credit freeze is the step the FTC recommends to block new accounts in your name.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
