AspenPointe aspenpointe.org AspenPointe data breach: what happened and what to do
AspenPointe, a Colorado Springs behavioral health provider, reported to HHS on November 19, 2020 that a network breach affected 295,617 people. Exposed data included names, dates of birth, Social Security numbers, and claims and financial information.
View all 13,177 breaches- Breach date
- 12 Sept 2020
- Made public
- 19 Nov 2020
- Affected
- 295,617
- Data exposed
- Names, Dates of birth, Social security numbers, Claims information, Financial information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
AspenPointe is a behavioral health provider in Colorado Springs, Colorado. In its notification letter, sent to patients on November 19, 2020, it said it had discovered that someone gained unauthorized access to its network between September 12, 2020 and about September 22, 2020. The same day, AspenPointe reported the breach to the U.S. Department of Health and Human Services (HHS) as affecting 295,617 people.
HHS describes the incident as a ransomware attack that affected protected health information (PHI), and lists it under hacking or an IT incident. AspenPointe told HHS and the affected people, notified the media, and put technical and administrative safeguards in place. HHS's Office for Civil Rights also gave AspenPointe technical assistance on its HIPAA obligations.
Sources checked: ocrportal.hhs.gov, beckershospitalreview.com, infosecurity-magazine.com
Last verified against the official page:
What was exposed
According to HHS, the data included names, dates of birth, Social Security numbers, and claims and financial information. Press coverage of the notice adds Medicaid ID numbers, dates of last visit, admission and discharge dates, and diagnosis codes for patients. For employees, it reports names, dates of birth, Social Security numbers, driver's license numbers and, in some cases, bank account information.
A Social Security number paired with a date of birth is what criminals need to open credit in someone's name or file a fake tax return. Treatment details are a different risk: they make phishing calls and letters ("we're calling about your recent visit") much more believable.
The company's response
AspenPointe offered 12 months of complimentary identity theft protection and a $1 million insurance reimbursement policy to affected people. If you received a letter, the FTC advises reading it carefully and taking the free credit monitoring if it's offered.
What this means for you
If your Social Security number was in the notice, the step that matters most is a credit freeze. The FTC says it's free and lasts until you lift it. If you only got a letter about health information, watch your insurance statements for services you didn't receive.
What to do if you were in it
- 1
Read your notice letter and take the free protection
AspenPointe offered 12 months of identity theft protection. The FTC recommends reading the notice and enrolling if you're offered it.
- 2
Freeze your credit at all three bureaus
Your Social Security number may be exposed, so place a free credit freeze at Equifax, Experian and TransUnion. The FTC explains how.
- 3
Check your insurance and Medicaid statements
Look at explanation of benefits statements for treatment or claims you don't recognize, and report them to your insurer.
- 4
Expect scams that mention your care
Treat calls, texts and emails about your treatment or a breach refund as suspect. Contact AspenPointe or your insurer using a number you look up yourself.
- 5
Report identity theft if it happens
If someone uses your details, report it at IdentityTheft.gov for a recovery plan. You can also run a free Serus scan to see which breaches include your email or phone.
Official filings
- U.S. Department of Health and Human Services , filed 19 Nov 2020 : 295,617 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the AspenPointe breach?
AspenPointe sent letters to the 295,617 people it reported to HHS. If you didn't get one, you were most likely not affected, but you can contact AspenPointe to ask.
What data was exposed?
HHS lists names, dates of birth, Social Security numbers, and claims and financial information. Press coverage of the notice adds Medicaid IDs and diagnosis codes for patients.
Should I freeze my credit?
If your Social Security number was in the notice, yes. A freeze is free and stops most new accounts being opened in your name.
Is the data still at risk?
Once personal data leaks, it can't be taken back, so the protection is making it less useful: a credit freeze and watching statements.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- beckershospitalreview.com/healthcare-information-technology/cybersecurity/colorado-health-provider-alerts-295-617-patients-of-data-breach/
- infosecurity-magazine.com/news/aspenpointe-cyber-attack/
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
