Cardiovascular Consultants Ltd. cvcheart.com Cardiovascular Consultants data breach: what happened and what to do
Cardiovascular Consultants, an Arizona heart practice, reported a cyberattack that affected 484,000 people. Exposed data included names, addresses, dates of birth, driver's license and Social Security numbers, diagnoses and claims information.
View all 13,115 breaches- Breach date
- 27 Sept 2023
- Made public
- 1 Dec 2023
- Affected
- 484,000
- Data exposed
- Names, Physical addresses, Dates of birth, Driver's licenses, Social security numbers, Treatment information, Medical information
- Last updated
What happened
Cardiovascular Consultants Ltd., a cardiology practice in Arizona, reported to HHS on 1 December 2023 that a cyberattack had compromised the protected health information of 484,000 people. The practice noticed suspicious activity on 29 September 2023, and a security firm found that unauthorised people had been in its systems on or before 27 September.
Reporting says files with patient information were copied before ransomware encrypted others. The Qilin ransomware group listed the practice on its leak site, but that claim is unconfirmed.
The affected people include current and former patients and others tied to their care, such as the person responsible for a bill or the holder of an insurance policy.
What was exposed
HHS's description says the data included names, addresses, dates of birth, driver's license and Social Security numbers, diagnoses, claims information and other treatment information.
That combination supports identity theft and medical fraud. A Social Security number and driver's license can be used to open accounts, and diagnosis details help scammers write convincing calls about test results or bills.
The company's response
The practice notified HHS, affected people and the media, and put in place more administrative and technical safeguards. A class action followed, and a $3.85 million settlement fund was reported in secondary coverage. Check the official settlement website for current deadlines.
What this means for you
If you've been a patient there, or a guarantor, watch for letters and act on them. A credit freeze is the strongest single step.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
Because identity numbers were involved, place a free credit freeze at Equifax, Experian and TransUnion. A freeze stops anyone opening new credit in your name. Lift it temporarily when you apply for credit yourself.
- 2
Check your medical and insurance statements
Look for services or claims you didn't receive and report them to your insurer straight away.
- 3
Replace your driver's license if you're concerned
A license number was exposed. Ask your state motor vehicle agency whether you can flag your record or get a new number.
- 4
Be careful with calls and texts about your health
Scammers use diagnosis details to sound real. Call the practice on its published number before sharing anything.
- 5
Check the settlement site
A class action settlement was reported. If you're a patient, find the official settlement website and see whether you can claim.
Frequently asked
Was I affected by the Cardiovascular Consultants breach?
If you were a patient or involved in a patient's care, you may have received a notice. The practice reported 484,000 affected people.
What was exposed?
Names, addresses, dates of birth, driver's license and Social Security numbers, diagnoses, claims and treatment information.
Is there a settlement?
Secondary reporting describes a $3.85 million class action settlement. Confirm the details and deadlines on the official settlement website.
Should I freeze my credit?
Yes. Social Security numbers were exposed, and a free freeze at all three bureaus blocks new credit in your name.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
