CareATC careatc.com CareATC data breach 2021: what happened and what to do
CareATC, an Oklahoma health care provider, reported an email compromise from June 18, 2021 that affected 98,774 people. Names, addresses, dates of birth, driver's license and Social Security numbers, claims, medications, diagnoses and lab results were exposed.
View all 13,177 breaches- Breach date
- 18 Jun 2021
- Affected
- 98,774
- Data exposed
- Names, Addresses, Dates of birth, Driver's licenses, Social security numbers, Medications, Diagnoses, Lab results
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
CareATC provides workplace health care to employees and their families. It reported that employee email accounts were accessed by an unauthorized party between June 18 and June 29, 2021. HHS describes the cause as a phishing attack on several employees. CareATC became aware of suspicious activity on June 29 and later ran a forensic investigation to work out what the accounts held.
HHS lists the breach as affecting 98,774 people.
Sources checked: ocrportal.hhs.gov, hipaajournal.com, healthitsecurity.com
Last verified against the official page:
What was exposed
Per HHS, the information included names, addresses, dates of birth, driver's license numbers, Social Security numbers, claims information, medications, diagnoses and lab results. Which details were in your file varies, and the notice letter says which applied to you.
Email accounts that hold patient records give criminals material for targeted scams, such as a message that quotes a real medication or claim. Driver's license and Social Security numbers can be used to apply for credit or open accounts in your name.
The company's response
CareATC notified HHS, affected people and the media, set up a call center, and offered complimentary credit monitoring. It also retrained its staff and added safeguards to its email systems.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A credit freeze is free and stops lenders from opening new accounts in your name. Place one at Equifax, Experian and TransUnion, as the FTC explains. This matters most if your letter lists a Social Security or driver's license number.
- 2
Use the free credit monitoring if you were offered it
The notice letter explains how to enrol, and there is a deadline. The FTC recommends taking free credit monitoring when a company offers it. Enrolment is separate from a freeze, so do both.
- 3
Read your insurance and medical statements
Check the statements from your health insurer and your care provider. Report treatment, claims or bills you don't recognize to the insurer, since someone may be using your details to get care.
- 4
Be wary of messages that mention the breach
Scammers use real details to sound credible. Don't click links or call numbers in unexpected texts, emails or calls about your health plan, prescriptions or the breach. Go to the organization's own website instead. If you spot a scam, report it at IdentityTheft.gov.
- 5
Check whether your email or phone is in other breaches
Serus monitors breach databases and the dark web and alerts you when your details show up. Run a free scan to see where you stand. Our guide to what to do after a data breach covers the rest.
Official filings
- U.S. Department of Health and Human Services , filed 27 Aug 2021 : 98,774 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the CareATC breach?
HHS lists 98,774 people. CareATC sent letters to people whose information was in the compromised email accounts. If you used CareATC services and have no letter, contact the company.
Was it phishing or ransomware?
HHS describes it as a phishing attack on employees that gave an unauthorized party access to email accounts. HHS doesn't describe ransomware.
Should I get new identity documents?
The FTC's guidance is to match your steps to what was exposed. If a driver's license number was involved, a credit freeze and fraud watch come first. Your state motor vehicle agency can say what else is available.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- hipaajournal.com/careatc-email-accounts-accessed-by-unauthorized-individuals/
- healthitsecurity.com/news/98k-patients-employees-impacted-by-oklahoma-provider-data-breach
- atg.wa.gov/data-breach-notifications
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
