Arietis Health arietishealth.com Arietis Health data breach: what happened and what to do
Arietis Health, a medical billing company, reported a 2023 hack of its MOVEit file transfer software that affected 1,975,066 patients, according to HHS. Exposed data included Social Security numbers, dates of birth, health insurance details and diagnosis and treatment information.
View all 13,115 breaches- Breach date
- May 2023
- Made public
- 28 Sept 2023
- Affected
- 1,975,066
- Data exposed
- Social security numbers, Dates of birth, Health insurance information, Medical information, Treatment information
- Last updated
What happened
Arietis Health is a billing company that works with healthcare providers, including NorthStar Anesthesia. In late May 2023 an attacker got into its MOVEit Transfer server, a file transfer tool that Arietis used to move large files containing patient records. MOVEit had a flaw that was exploited against many organizations that month. Arietis reported the incident in late September 2023, and the U.S. Department of Health and Human Services (HHS) lists it as a hacking incident affecting 1,975,066 people.
Because Arietis handles billing for other organizations, many of the people affected had never heard of it. Patients of at least 54 healthcare entities linked to NorthStar Anesthesia were notified.
What was exposed
Reports on the breach describe Social Security numbers, dates of birth, medical record numbers, health insurance details, and diagnosis and treatment information. HHS describes the data as clinical and demographic information.
That mix matters. A Social Security number and a date of birth together are what criminals need to open credit in your name or file a fake tax return, sometimes years later. Health insurance details can be used for medical identity theft, where someone bills care to your policy. And the details also make phishing more convincing: a message that knows your provider and your procedure looks real.
The company's response
According to HHS, Arietis told affected people, HHS and the media, and provided substitute notice. The company offered complimentary credit monitoring and added security safeguards. A class action over the breach was reported to have reached a settlement of $2.8 million, according to HIPAA Journal.
What to do
Read the letter if you got one, then freeze your credit and watch your insurance statements. The steps below cover it.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A Social Security number and date of birth were involved, so place a free credit freeze at Equifax, Experian and TransUnion. It blocks most new accounts in your name and you can lift it when you apply for credit.
- 2
Take the free credit monitoring if you were offered it
The notice letter explains how to enroll. Monitoring alerts you to new activity, but it doesn't block it, so pair it with the freeze.
- 3
Read your insurance statements
Check every explanation of benefits for care you didn't receive. If something looks wrong, call your insurer and ask them to flag the account.
- 4
Expect phishing that mentions your provider
Messages that cite your provider, a billing balance or a data breach can be scams. Go to the company's website yourself instead of clicking a link.
- 5
Check whether your email or phone is in this and other breaches
A free Serus scan checks breach databases for your email and phone number and tells you what to do next. Serus can't remove breach data, but it alerts you when your details show up.
Frequently asked
Was I affected by the Arietis Health breach?
If you were treated at a facility linked to NorthStar Anesthesia, you may have received a letter in late 2023. Arietis was a billing vendor, so the letter might have come from your provider or from Arietis.
What was exposed in the Arietis Health breach?
Reports describe Social Security numbers, dates of birth, medical record numbers, health insurance details, and diagnosis and treatment information. HHS lists clinical and demographic information.
Is there a settlement?
HIPAA Journal reported a $2.8 million class action settlement over the breach. Check the settlement notice you received or the court's website for the claim details and deadlines.
Should I freeze my credit?
Yes, if your Social Security number may have been exposed. A freeze is free at Equifax, Experian and TransUnion.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
