Magellan Healthcare magellanhealth.com Magellan Healthcare data breach: what happened and what to do
Magellan Healthcare reported an April 2020 ransomware attack to HHS affecting 50,410 people. Its notice listed treatment and health insurance details, contact information and, in some cases, Social Security numbers.
View all 13,177 breaches- Breach date
- 11 Apr 2020
- Affected
- 50,410
- Data exposed
- Health insurance information, Treatment information, Email addresses, Phone numbers, Physical addresses, Social security numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Magellan Healthcare, a health care management company in Maryland, reported a ransomware attack to the U.S. Department of Health and Human Services (HHS). The filing counts 50,410 people. Magellan has said it discovered the attack on April 11, 2020, and press coverage of its notice says the intruders got in through a phishing email sent on April 6 that impersonated a Magellan client.
The attack hit more than one Magellan entity. Each affected organization had to file its own report, so the same incident shows up several times in HHS's records. Added together, coverage put the total at about 365,000 people. HHS closed the 50,410-person case and folded it into an existing investigation.
Sources checked: hipaajournal.com, ocrportal.hhs.gov, consumer.ftc.gov
Last verified against the official page:
What was exposed
Magellan's notice said the data included treatment information, health insurance account details, member ID numbers, email addresses, phone numbers and physical addresses. In some cases Social Security numbers were involved too.
What that means for you
Contact details plus health plan information are what scammers use for convincing phishing and phone calls, such as a caller who claims to be from your insurer. A Social Security number is the more serious item: with it, someone can try to open credit in your name or file a tax return as you.
Magellan hasn't said the data was misused, and nobody can undo a breach. What you can do is limit what the data is useful for. The steps below cover that.
What to do if you were in it
- 1
Expect messages that mention the breach
Insurer-style calls, texts and emails that quote your plan or provider are the likeliest follow-up. Don't click links or call numbers in them. Go to the company's own website instead, as the FTC advises.
- 2
Read your insurance statements
Check the explanation of benefits your insurer sends. If it lists care you didn't get, call the insurer and report it.
- 3
Freeze your credit
If your Social Security number or date of birth was involved, place a free credit freeze at Equifax, Experian and TransUnion. The FTC explains how. A freeze blocks most new accounts opened in your name and you can lift it whenever you apply for credit.
- 4
Report misuse
If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus keeps watching and alerts you when they show up in a new leak.
Official filings
- U.S. Department of Health and Human Services , filed 12 Jun 2020 : 50,410 people
- U.S. Department of Health and Human Services , filed 17 Sept 2019 : 55,637 people
Timeline
-
Reported to U.S. Department of Health and Human Services
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Magellan Healthcare breach?
If you got a notice letter from Magellan, yes. HHS lists 50,410 people for this report. If you're unsure, contact Magellan or your health plan.
What data was exposed?
Magellan's notice listed treatment information, health insurance account details, member IDs, email addresses, phone numbers and physical addresses, plus Social Security numbers in some cases.
Should I freeze my credit?
If your Social Security number was in your notice, yes. A freeze is free at Equifax, Experian and TransUnion, according to the FTC.
Sources
- hipaajournal.com/magellan-health-suffers-ransomware-attack/
- hipaajournal.com/extent-of-magellan-health-ransomware-becomes-clear-more-than-364000-individuals-affected/
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
