American Anesthesiology americananesthesiology.com

American Anesthesiology data breach: what happened and what to do

American Anesthesiology reported to HHS that a phishing attack on its business associate exposed data of 1,269,074 people. Email accounts were accessed from June 17, 2020. Data included names, dates of birth, Social Security and driver's license numbers, diagnoses, medications and financial details.

View all 13,177 breaches

Breach date: 17 Jun 2020
Made public: 8 Jan 2021
Affected: 1,269,074
Data exposed: Names, Dates of birth, Social security numbers, Driver's licenses, Treatment information, Medications, Bank account numbers
Last updated: 27 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

American Anesthesiology, a physician group, told HHS that several email accounts at its business associate (a company that handles data for it) were compromised in a phishing attack. The unauthorized access ran from June 17 to June 22, 2020, and was discovered on July 16, 2020, according to the Maine Attorney General's listing. Notices went out in January 2021.

The HHS breach portal lists 1,269,074 people. Some filings show different totals, so treat the HHS figure as the one American Anesthesiology reported to the federal regulator.

Sources checked: ocrportal.hhs.gov, govinfosecurity.com, maine.gov

Last verified against the official page: 27 Oct 2026

How we research this Report an error

What was exposed

HHS's description lists names, dates of birth, Social Security and driver's license numbers, diagnoses, lab results, medications, and financial and other treatment information. Notices described in GovInfoSecurity coverage also named billing details.

With a Social Security number and date of birth, someone can try to open credit in your name. With diagnosis and medication details, scammers can write a message that sounds like it comes from your doctor or insurer.

The company's response

HHS says the business associate added administrative and technical safeguards and retrained all staff on email security. Reports at the time said people whose Social Security numbers were involved were offered a year of Experian credit monitoring.

What to do if you were in it

1

Freeze your credit at all three bureaus

A credit freeze is free and stops lenders from seeing your credit report, which blocks most new accounts in your name. Place it separately at Equifax, Experian and TransUnion, as the FTC explains. Do this first: Social Security numbers and dates of birth were exposed.
2

Use the free monitoring if you were offered it

Check your letter for credit monitoring through Experian and its enrollment deadline. The FTC recommends taking free credit monitoring when a company offers it. Monitoring alerts you to new activity but doesn't block it, so pair it with a freeze.
3

Read your insurance statements

Check explanation of benefits statements from your insurer and question any treatment or bill you don't recognize. The FTC lists medical identity theft warning signs.
4

Treat messages about your care or bills as suspect

Expect calls, texts and emails that mention a procedure, a bill or your insurance. Contact the provider on a number you look up yourself.
5

Check your credit reports and statements

Review your reports for free at annualcreditreport.com and read bank statements for charges you don't recognize. If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
6

Check whether your email or phone is in this and other breaches

Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus keeps watching and alerts you if they turn up in a new leak.