Bay Bridge Administrators baybridgeadministrators.com Bay Bridge Administrators data breach: what happened and what to do
Bay Bridge Administrators reported a ransomware incident that affected 187,742 people, per HHS. Names, addresses, dates of birth and driver's license information were involved. The breach began around September 3, 2022 and was reported in December 2022.
View all 13,177 breaches- Breach date
- 3 Sept 2022
- Made public
- 29 Dec 2022
- Affected
- 187,742
- Data exposed
- Names, Physical addresses, Dates of birth, Driver's licenses
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Bay Bridge Administrators is a business associate, a company that handles health plan administration on behalf of other organizations. It told HHS that a ransomware incident affected the protected health information of 187,742 people.
What happened
Breach filings give September 3, 2022 as the start date of the incident. The notification went to HHS, to California and Washington regulators, and to the people affected in late December 2022. Bay Bridge describes the event as ransomware, which means attackers got into its systems and locked or took files.
Sources checked: ocrportal.hhs.gov, oag.ca.gov, atg.wa.gov
Last verified against the official page:
What was exposed
HHS's description lists names, addresses, dates of birth, drivers' license information and other identifiers. A driver's license number with a name and date of birth is enough for criminals to attempt account takeovers, forged IDs and fraudulent applications.
The company's response
Bay Bridge notified HHS, the people affected and the media, and provided substitute notice. It put new administrative and technical safeguards in place and retrained staff on protecting health information.
What it means for you
Many people in this breach never dealt with Bay Bridge directly. It worked for employers and health plans. If you got a letter, it names the plan or employer whose data was involved. The practical risk is identity fraud rather than medical details, because HHS doesn't list diagnoses or treatment information for this case.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A freeze stops new credit being opened in your name and costs nothing. Place it with Equifax, Experian and TransUnion; the FTC explains how at consumer.ftc.gov. Lift it temporarily when you apply for credit yourself.
- 2
Read the notice letter and use the protection it offers
If a letter arrived, it lists what was exposed and often includes free credit monitoring or identity restoration with an enrollment deadline. Sign up before that date passes.
- 3
Watch your statements and credit reports
Check bank and card statements for charges you don't recognize, and pull your free credit reports at AnnualCreditReport.com. If something is wrong, report it at IdentityTheft.gov and follow the recovery plan it gives you.
- 4
Expect phishing that mentions the breach
Scammers use news of a breach to sound legitimate. Don't click links or call numbers in unexpected texts or emails about it. Contact the company through the phone number or site on your own card or statement.
- 5
Check whether your email or phone is in this and other breaches
Serus monitors breach databases and the dark web and alerts you when your details appear, with steps for each case. A free scan shows where you stand today.
Official filings
- U.S. Department of Health and Human Services , filed 29 Dec 2022 : 187,742 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by this breach?
Check the notice letter you received. Organizations usually mail one to each person whose data was involved. If you have no letter and think your data was held, contact Bay Bridge Administrators using the details on its own website.
Should I freeze my credit?
If your Social Security number or similar ID details were exposed, the FTC says a credit freeze is a free way to block new accounts being opened in your name. Place it with Equifax, Experian and TransUnion.
What should I do if I get a message about the breach?
Treat it with care. Criminals send fake breach alerts. Go to the company's own site or the number on your statements instead of using a link or number in the message.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
