Yale University yale.edu Yale University data breach: what happened and what to do
Yale University told the US health regulator HHS that a ransomware incident exposed the health information of 9,051 people. The data included names, Social Security numbers, driver's license numbers, dates of birth, financial and claims details, diagnoses and medications.
View all 13,177 breaches- Breach date
- 11 Nov 2022
- Affected
- 9,051
- Data exposed
- Names, Social security numbers, Physical addresses, Driver's licenses, Dates of birth, Financial information, Claims information, Diagnoses, Medications, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Yale University reported a ransomware incident to the US Department of Health and Human Services (HHS), which publishes health data breaches affecting 500 or more people. The entry was added to HHS's public breach list in November 2022 and says the incident affected the protected health information of 9,051 people.
What was exposed
HHS's case description lists names, Social Security numbers, addresses, driver's license numbers, dates of birth, financial and claims information, diagnoses, medications and other treatment information. That mix matters. A Social Security number plus a date of birth and a driver's license number is what criminals need to open credit in someone's name. Diagnoses and medications are sensitive in a different way: they can be used to make a scam message sound believable.
How the company responded
Per HHS, Yale notified HHS, the affected individuals and the media, and posted a notice on its website. It offered free credit monitoring to the people affected and added administrative, technical and security safeguards. Staff were also retrained on protecting health information.
What it means for you
If you received a letter from Yale, the data listed in it is what to plan around. Don't assume you're safe because you never got one, but don't assume you're affected either. The letter is the only reliable answer. HHS didn't publish a start date for the attack in this entry, so the timeline here is limited to what HHS reports.
The steps below follow the guidance from the FTC. The credit freeze is the one that does the most work when a Social Security number is involved.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What to do if you were in it
- 1
Read the Yale letter and use the credit monitoring offer
If you got a notice, it lists exactly what was exposed and how to sign up for the free monitoring Yale offered. Use the sign-up details printed on your own letter.
- 2
Freeze your credit at all three bureaus
A credit freeze is free and stops new accounts being opened in your name. Ask Equifax, Experian and TransUnion separately, as the FTC explains at consumer.ftc.gov. You can lift it whenever you need to apply for credit.
- 3
Watch your statements and credit reports
Check your bank and card statements for charges you don't recognize, and pull your free reports at annualcreditreport.com. If something looks wrong, report it at IdentityTheft.gov, the FTC's reporting site.
- 4
Check your medical statements
Look at explanation of benefits statements from your insurer for services you didn't receive. Medical identity theft shows up there first.
- 5
Expect phishing that mentions the breach
Scammers use real names and addresses to sound credible. Don't click links in unexpected emails or texts, and contact the organization using the number on its official website.
- 6
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases and the dark web for your email and phone number and tells you what to do next. Serus can't remove data from a breach, but it alerts you when your details turn up.
Frequently asked
Was I affected by the Yale University data breach?
Affected people were notified directly, according to HHS. If you got a letter, you were affected. If you didn't and think you should have, contact Yale using the details on its official website.
What was exposed?
HHS lists names, Social Security numbers, addresses, driver's license numbers, dates of birth, financial and claims information, diagnoses, medications and treatment information.
How many people were affected?
HHS lists 9,051 individuals.
Should I freeze my credit?
Yes, if your Social Security number was involved. The FTC says a freeze is free and blocks new accounts opened in your name.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
