UnityPoint Health unitypoint.org UnityPoint Health data breach 2018: what happened and what to do
Phishing emails tricked UnityPoint Health employees into giving up logins, which let attackers into internal email accounts between March 14 and April 3, 2018. About 1.4 million patients may have been affected. UnityPoint found it on May 31 and reported it July 30, 2018.
View all 13,177 breaches- Breach date
- 14 Mar 2018
- Made public
- 30 Jul 2018
- Affected
- 1,400,000
- Data exposed
- Medical information, Social security numbers, Driver's licenses, Credit cards, Bank account numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
UnityPoint Health, a health system serving Iowa, Illinois and Wisconsin, said attackers got into internal email accounts between March 14 and April 3, 2018. The way in was phishing: emails that looked like they came from an executive led some employees to hand over their login details. UnityPoint discovered the incident on May 31, 2018 and reported it on July 30, 2018.
News outlets reported that about 1.4 million patients may have had information compromised. The company said the attackers appeared to be trying to divert payroll or vendor payments through the email system. A separate phishing incident earlier in 2018 involved about 16,400 patients and is a different event.
Sources checked: hcinnovationgroup.com, scmagazine.com, fiercehealthcare.com
Last verified against the official page:
What was exposed
Reports describe clinical and identifying details in the affected mailboxes. For some patients that included Social Security numbers, driver's license numbers, payment card numbers and bank account numbers. Not every patient had every type of data exposed.
What it means for you
A Social Security number plus identifying details is what someone needs to open credit in your name. Medical details make convincing phishing, because a message can mention a real provider or visit.
What UnityPoint did
UnityPoint notified affected patients. It later agreed to a proposed $2.8 million settlement covering patients affected by the two phishing-related breaches, according to news reports. Check the settlement's current status before relying on it.
What to do if you were in it
- 1
Freeze your credit
If you got a notice that your Social Security number was involved, place a free credit freeze at Equifax, Experian and TransUnion. The FTC explains how.
- 2
Replace exposed cards and watch accounts
If a card or bank account number was in your notice, ask the bank for a new one and watch statements for charges you don't recognize.
- 3
Expect healthcare phishing
Messages that mention a visit, a bill or a provider may be scams. Don't click links or call numbers in them; contact the provider using details from its website.
- 4
Report misuse
If someone uses your details, report it at IdentityTheft.gov.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up, but it can't remove data from a breach.
Official filings
- California Attorney General , filed 30 Jul 2018
Timeline
-
The breach happened
-
The company made it public
-
Reported to the California Attorney General
Frequently asked
Was I affected by the UnityPoint Health breach?
UnityPoint notified patients whose information was in the affected email accounts. If you didn't get a letter, you were probably not included, but you can contact UnityPoint to ask.
What was exposed?
Clinical and identifying details, and for some patients Social Security numbers, driver's license numbers, payment card numbers and bank account numbers, according to news reports.
Is there a settlement?
News reports describe a proposed $2.8 million settlement covering two 2018 phishing-related breaches. Confirm its current status with the settlement administrator.
Should I change my password?
No patient passwords are reported as exposed. The logins that were phished belonged to employees.
Sources
- hcinnovationgroup.com/cybersecurity/article/13010398/unitypoint-says-14-million-affected-in-phishing-scam
- scmagazine.com/news/phishing-attack-compromised-the-data-of-1-4-million-unitypoint-health-patients
- fiercehealthcare.com/tech/unitypoint-health-agrees-to-2-8m-settlement-2018-data-breach-case
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
