Blackhawk musc.edu Blackhawk data breach: what happened and what to do
Hackers broke into the online payment portal of Blackhawk, a billing vendor for the Medical University of South Carolina (MUSC), on June 30, 2013. The breach exposed names, addresses, email addresses and credit card information for 7,120 people.
View all 13,177 breaches- Breach date
- 30 Jun 2013
- Made public
- 9 Oct 2013
- Affected
- 7,120
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
MUSC Physicians and the Medical University Hospital Authority learned on August 22, 2013, that the payment portal run by their billing vendor had been hacked. According to the U.S. Department of Health and Human Services (HHS) breach report, the intrusion happened on June 30, 2013. The vendor is listed as Blackhawk Statement Group, though some news outlets call it Blackhawk Consulting Group. People who paid a bill by card online or by phone were affected, as HealthExec reported.
Sources checked: ocrportal.hhs.gov, healthexec.com, campustechnology.com
Last verified against the official page:
What was exposed
HHS records 7,120 people. The exposed data was names, addresses, email addresses and credit card information. The notice and press coverage said Social Security numbers, birth dates and medical records were not involved, as Campus Technology reported.
What that lets criminals do
Card details can be used for fraudulent purchases until the card is replaced. A name, address and email address also make phishing messages look convincing, for example a fake message about a medical bill.
The response
MUSC changed its payment process so card transactions no longer go through the vendor, and the vendor fixed the software flaw that was exploited. HHS's Office for Civil Rights accepted these corrective actions. Affected patients were told by letter and offered credit monitoring.
What to do if you were in it
- 1
Ask your card issuer for a new card
If you paid MUSC by card in mid-2013, call the number on the back of the card and ask about a replacement. Check old statements for charges you don't recognize.
- 2
Expect billing phishing
Messages that mention a medical bill or payment and ask you to click or call are a common follow-up. Go to the provider's own website or phone number instead.
- 3
Report misuse
If your details are used, report it and get a recovery plan at IdentityTheft.gov.
- 4
Check where else your data shows up
Run a free Serus scan to see whether your email or phone number appears in this or other breaches.
Official filings
- U.S. Department of Health and Human Services , filed 9 Oct 2013 : 7,120 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Blackhawk breach?
If you paid an MUSC bill by card online or by phone between late June and August 2013, you may have been. HHS counts 7,120 people, and MUSC contacted them by letter.
What was exposed?
Names, addresses, email addresses and credit card information, according to HHS.
Were my medical records leaked?
MUSC said medical records were not involved, according to news coverage of its notice.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- healthexec.com/topics/health-it/cybersecurity/hackers-theft-credit-card-info-impacts-7k-sc
- campustechnology.com/articles/2013/09/17/medical-university-of-sc-suffers-theft-of-credit-card-info-through-third-party-provider.aspx
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
