Norwood Clinic norwoodclinic.com Norwood Clinic data breach: what happened and what to do
Norwood Clinic in Birmingham, Alabama, found a cyberattack on October 22, 2021 that began in September. It notified 228,103 patients. Exposed data may include names, Social Security numbers, driver's licenses, some health information and insurance policy numbers.
View all 13,177 breaches- Breach date
- 20 Sept 2021
- Affected
- 228,103
- Data exposed
- Names, Phone numbers, Physical addresses, Dates of birth, Social security numbers, Driver's licenses, Medical information, Health insurance information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Norwood Clinic, a medical practice in Birmingham, Alabama, discovered on October 22, 2021 that an attacker had gained unauthorized access to data on its network. Reporting based on the clinic's filings says the access began around September 20, 2021. The clinic secured and restored its systems and hired cybersecurity experts to investigate.
The investigators could not determine which files the attacker viewed, so Norwood Clinic notified every patient whose data sat in the affected folders: 228,103 people, matching the roughly 228,000 on the HHS breach portal.
What was exposed
The affected folders held names, contact details, dates of birth, Social Security numbers, driver's license numbers, some health information and health insurance policy numbers. Not every person had every item.
A Social Security number with a date of birth is enough to apply for credit in your name. A driver's license number can support fake ID. Health insurance numbers can be misused to bill for care you never got.
The company's response
Norwood Clinic offered all patients free credit monitoring, dark web monitoring and identity theft protection. It also tightened email settings, network hardware, password rules and login controls. The notice does not say whether ransomware was involved.
Sources checked: consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What to do if you were in it
- 1
Freeze your credit at all three bureaus
Your Social Security number was involved, so a credit freeze is the strongest step. The FTC says it's free and you place it separately at Equifax, Experian and TransUnion. A freeze stops lenders from seeing your report, which blocks most new accounts opened in your name.
- 2
Enroll in the free protection services
The notice letter explains how. The FTC recommends using free credit monitoring when a company offers it after a breach.
- 3
Read your insurance explanation of benefits
Look for services or providers you don't recognize. If you find any, tell your insurer and report it at IdentityTheft.gov.
- 4
Watch your accounts and statements
Check bank and card statements and your credit reports for anything you don't recognize. You can get free reports at annualcreditreport.com. If something looks wrong, report it at IdentityTheft.gov, the FTC's reporting site.
- 5
Expect scams that mention the breach
Contact details tied to a real company make phishing emails, texts and calls more convincing. Don't click links or give out information on an unexpected message. Contact the company using a number from its official website instead.
Official filings
- U.S. Department of Health and Human Services , filed 25 Feb 2022 : 228,000 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Norwood Clinic breach?
Norwood Clinic notified 228,103 patients. If you got a letter, your data was in the affected folders. If you were a patient and didn't, contact the clinic.
What was exposed?
Names, contact details, dates of birth, Social Security numbers, driver's license numbers, some health information and health insurance policy numbers. It varied by person.
Should I freeze my credit?
If your Social Security number was in your notice, yes. The FTC says a freeze is free and you place it at each of the three bureaus.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
