Optum360 data breach: what happened and what to do

Optum360 told HHS that a cyber-attack on its collections vendor, American Medical Collection Agency, affected about 11.5 million people. The data included names, addresses, phone numbers, dates of birth, Social Security numbers, financial and treatment information.

View all 13,177 breaches

Breach date: Aug 2018
Made public: 1 Jul 2019
Affected: 11,500,000
Data exposed: Names, Physical addresses, Phone numbers, Dates of birth, Social security numbers, Financial information, Treatment information
Last updated: 25 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

Optum360 is a medical billing company that works with Quest Diagnostics. It reported to the U.S. Department of Health and Human Services (HHS) that its business associate, the collections firm American Medical Collection Agency (AMCA), was hit by a cyber-attack. Optum360 says the attack affected the electronic health information of about 11.5 million people, and HHS lists the case at 11,574,452 individuals.

Press coverage of the wider AMCA incident says Quest and Optum360 got notice from AMCA on May 14, 2019 about unauthorized activity on AMCA's web payment page. AMCA's system is reported to have been exposed from August 2018 to March 2019. The same incident hit other AMCA clients, which is why you may see different totals in different stories.

Sources checked: ocrportal.hhs.gov, govinfosecurity.com, bankinfosecurity.com

Last verified against the official page: 25 Oct 2026

How we research this Report an error

What was exposed

HHS says the information included names, addresses, phone numbers, dates of birth, Social Security numbers, financial information and other treatment information. Laboratory test results were not part of what AMCA reported.

That mix matters. A name, date of birth and Social Security number together are what a criminal needs to open a credit account or file a tax return in your name. Phone numbers and addresses make phishing and fake billing calls more believable, since the caller can mention a real lab or a real debt.

The company's response

Optum360 notified HHS, the people affected and the media, and posted a notice on its website. After the breach was found, it ended its business relationship with AMCA. AMCA's parent company later filed for bankruptcy.

What this means for you

If you got a letter, treat the Social Security number as exposed for good. A breach like this can't be reversed, and a stolen number stays useful for years. The steps below limit the damage.

What to do if you were in it

1

Freeze your credit at all three bureaus

A freeze is free and stops most new accounts being opened in your name. Place it separately at Equifax, Experian and TransUnion, as the FTC explains. Lift it when you apply for credit yourself.
2

Read your statements and explanation of benefits

Look for charges, accounts or medical services you don't recognize, and report anything odd to the company that sent it.
3

Expect messages that mention the breach

Scammers write to affected people with real details to sound credible. Don't click links in unexpected emails or texts. Go to the company's own site or the phone number on your card.
4

Report misuse

If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
5

Check whether your email or phone is in this and other breaches

A free Serus scan checks breach databases for your email, phone and other details and alerts you when they appear in a new leak.

Official filings

U.S. Department of Health and Human Services , filed 1 Jul 2019 : 11,500,000 people

Timeline

1 Aug 2018
The breach happened
1 Jul 2019
The company made it public
1 Jul 2019
Reported to U.S. Department of Health and Human Services

Frequently asked

Was I affected by the Optum360 breach?

You were notified by letter if so. If you used Quest Diagnostics and had a bill sent to collections around 2018 or 2019, check your mail and the company's notice.

What was exposed?

Names, addresses, phone numbers, dates of birth, Social Security numbers, financial information and other treatment information, per HHS. Lab test results were not part of it.

Should I freeze my credit?

Yes, if you were notified. A Social Security number was exposed, and a free freeze at all three bureaus blocks most new credit in your name.