Spectrum Health corewellhealth.org Spectrum Health data breach: what happened and what to do
A business associate of Spectrum Health suffered a ransomware attack that exposed data on about 52,711 people, per the HHS breach portal in September 2020. It included names, addresses, emails, birth dates, Social Security numbers and health insurance details.
View all 13,177 breaches- Breach date
- Sept 2020
- Affected
- 52,711
- Data exposed
- Names, Physical addresses, Email addresses, Dates of birth, Social security numbers, Health insurance information, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
In September 2020, Spectrum Health told the US Department of Health and Human Services (HHS) that one of its business associates, a vendor that handles patient information for it, had been hit by a ransomware attack. HHS's breach portal lists 52,711 people as affected.
What was exposed
HHS's description says the records held names, mailing addresses, email addresses, dates of birth, Social Security numbers, health insurance information and other treatment information. Spectrum Health notified HHS, the people affected and the media, and posted a substitute notice for anyone without a current mailing address.
The breach happened at a vendor, not on Spectrum Health's own systems. That's common in healthcare: a hospital shares data with a service provider, and the provider's security becomes the weak point. The HHS entry names neither the vendor nor an incident date.
What the data lets criminals do
The Social Security number and date of birth are the dangerous pair. With both, someone can try to open credit, file a tax return or claim benefits in your name. Insurance details can be used for medical identity theft, where someone gets care billed to your plan. Email addresses and addresses give scammers what they need for convincing phishing that mentions Spectrum Health.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What to do if you were in it
- 1
Freeze your credit
A credit freeze is free and stops lenders from opening new accounts in your name. Place it separately at Equifax, Experian and TransUnion, as the FTC explains. Lift it only when you apply for credit yourself.
- 2
Read your health insurance statements
Check explanation of benefits statements and medical bills for care you didn't get. If you see something wrong, call your insurer and the provider's billing office, and report it to the FTC at IdentityTheft.gov.
- 3
Expect messages that mention the breach
Criminals use your name, email address and health details to make scam emails, texts and calls sound real. Don't click links or call numbers in them. Go to the company's own site, or call the number on your card or statement.
- 4
Report misuse
If someone opens accounts or files claims in your name, report it at IdentityTheft.gov, the FTC's reporting site, which gives you a recovery plan.
- 5
Check where else your details are exposed
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus can't remove breach data, but it alerts you when your details turn up so you know when to repeat these steps.
Official filings
- U.S. Department of Health and Human Services , filed 1 Sept 2020 : 52,711 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Spectrum Health breach?
HHS lists about 52,711 people. Spectrum Health said it notified those affected, so look for a letter from 2020, and contact the organization if you were a patient and heard nothing.
What was exposed?
Names, mailing addresses, email addresses, dates of birth, Social Security numbers, health insurance information and other treatment information, according to HHS.
Whose systems were attacked?
HHS says a business associate of Spectrum Health was hit by ransomware. The entry doesn't name the vendor.
Should I freeze my credit?
Your Social Security number was in the data, so yes, a free freeze is the step the FTC recommends for that kind of exposure.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
