Atrium Health atriumhealth.org Atrium Health data breach: what happened and what to do
Atrium Health reported in December 2024 that tracking technology on its patient portal may have shared data of up to 585,959 people with Meta and Google between January 2015 and July 2019. No hacker was involved.
View all 13,115 breaches- Breach date
- Jan 2015
- Affected
- 585,959
- Data exposed
- IP addresses, Names, Email addresses, Phone numbers
- Last updated
What happened
Atrium Health reported to the US Department of Health and Human Services that 585,959 people may have been affected after it found online tracking technology on its patient portal, MyAtriumHealth (formerly MyCarolinas).
The tracking tools were active from January 2015 to July 2019. Atrium said they may have sent information about portal use to companies such as Meta and Google. Atrium couldn't determine what was actually sent, so it treated everyone who used the portal in that period as possibly affected and sent notices to them.
The information that may have been shared includes IP addresses and cookie identifiers. If you filled in a form on the portal, it could also include your name, email address, phone number, city, state, ZIP code and gender. Atrium said Social Security numbers, credit and debit card details and financial account information were not involved.
Atrium removed the tracking tools from the portal and said it strengthened its monitoring and its review of the technology it uses.
This is a privacy exposure rather than a theft. Nobody broke in. The practical risk is that advertising companies may hold data linking you to a health provider, and that contact details could feed targeted ads or phishing that mentions your care.
What to do if you were in it
- 1
Read your notice
If you got a letter or email from Atrium Health, it says what applies to you and who to contact.
- 2
Expect targeted phishing
Be wary of emails, texts and calls about your health care or bills. Contact Atrium through the number on its own website, not one in the message.
- 3
Limit what ad companies can collect
Use a browser that blocks third-party trackers and review the ad settings on your Google and Meta accounts.
- 4
Review your insurance statements
Check explanation-of-benefits statements for services you didn't receive.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases and the dark web for your email and phone number and tells you what to do next.
Frequently asked
Was I affected by the Atrium Health data breach?
Atrium treated every user of the MyAtriumHealth portal between January 2015 and July 2019 as possibly affected and sent notices accordingly.
Were Social Security numbers exposed?
Atrium said Social Security numbers, card details and financial account information were not involved in this incident.
Was Atrium Health hacked?
No. The incident involved tracking technology on its own portal, not an outside intrusion.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
