Navistar navistar.com Navistar data breach 2021: what happened and what to do
Navistar reported a cyberattack detected on May 20, 2021 that affected the health information of 49,000 people in its employee and retiree health plans. Exposed details included names, addresses, dates of birth, claims, medications and, for some people, Social Security numbers.
View all 13,177 breaches- Breach date
- 20 May 2021
- Affected
- 49,000
- Data exposed
- Names, Addresses, Dates of birth, Social security numbers, Medications, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Navistar, the truck maker, detected a cyberattack on its systems on May 20, 2021. According to HIPAA Journal, it confirmed on August 20, 2021 that files containing protected health information had been taken. The files belonged to participants in Navistar's employee health plan and its retiree health benefit and life insurance plan.
Navistar reported the breach to HHS as affecting 49,000 people, and sent notice letters in September 2021.
Sources checked: ocrportal.hhs.gov, hipaajournal.com, freightwaves.com
Last verified against the official page:
What was exposed
HHS lists names, addresses, dates of birth, Social Security numbers, claims information, medications and other treatment information. FreightWaves reports Navistar said a subset of people had their Social Security numbers exposed.
If your Social Security number was included, someone could use it with your date of birth to apply for credit or file a fake tax return. Claims and medication details are a hook for phishing that mentions your health plan or pharmacy.
The company's response
Navistar offered free credit monitoring and added administrative, technical and security safeguards, per HHS. OCR provided technical assistance. A class action was filed in federal court in Illinois in October 2021, FreightWaves reported.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A credit freeze is free and stops lenders from opening new accounts in your name. Place one at Equifax, Experian and TransUnion, as the FTC explains. Do this if your letter says your Social Security number was involved.
- 2
Use the free credit monitoring if you were offered it
The notice letter explains how to enrol, and there is a deadline. The FTC recommends taking free credit monitoring when a company offers it. Enrolment is separate from a freeze, so do both.
- 3
Read your insurance and medical statements
Check the statements from your health insurer and your health plan. Report treatment, claims or bills you don't recognize to the insurer, since someone may be using your details to get care.
- 4
Be wary of messages that mention the breach
Scammers use real details to sound credible. Don't click links or call numbers in unexpected texts, emails or calls about your health plan, retiree benefits or the breach. Go to the organization's own website instead. If you spot a scam, report it at IdentityTheft.gov.
- 5
Check whether your email or phone is in other breaches
Serus monitors breach databases and the dark web and alerts you when your details show up. Run a free scan to see where you stand. Our guide to what to do after a data breach covers the rest.
Official filings
- U.S. Department of Health and Human Services , filed 21 Sept 2021 : 49,000 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Who was affected by the Navistar breach?
Participants in the Navistar Health Plan and the Navistar Retiree Health Benefit and Life Insurance Plan. HHS lists 49,000 people. The letter you received says whether you were included.
Were Social Security numbers exposed?
For a subset of people, yes, according to Navistar's notice as reported by FreightWaves. Your letter says whether yours was.
Should I freeze my credit?
The FTC says a credit freeze is free and blocks most new accounts in your name. If your letter lists a Social Security number, it is a sensible step.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- hipaajournal.com/phi-of-navistar-health-plan-members-compromised-in-may-2021-cyberattack/
- freightwaves.com/news/navistar-sued-over-data-breach-affecting-thousands
- oag.ca.gov/privacy/databreach/list
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
