Cerebral cerebral.com Cerebral data breach: what happened and what to do
Cerebral told HHS that it may have disclosed the health information of 3,179,835 people through online tracking technologies. Names, addresses, birthdates, diagnoses and treatment information were involved. The disclosures began in October 2019 and were reported in March 2023.
View all 13,177 breaches- Breach date
- 12 Oct 2019
- Made public
- 1 Mar 2023
- Affected
- 3,179,835
- Data exposed
- Names, Physical addresses, Dates of birth, Diagnoses, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Cerebral, the online mental health and telehealth company, reported to HHS that it may have impermissibly disclosed the protected health information of 3,179,835 people. This was not a break-in by outside attackers. It involved tracking technologies on its website and app.
What happened
Tracking tools such as pixels and software development kits (SDKs) are small pieces of code that send information about what visitors do to outside companies, often for advertising and analytics. HHS's entry dates the incident to October 2019. Cerebral said such tools may have sent protected health information to third parties. It reported the incident in March 2023.
Sources checked: ocrportal.hhs.gov, oag.ca.gov, atg.wa.gov
Last verified against the official page:
What was exposed
HHS's description says the information included names, addresses, birthdates, diagnoses and other treatment information. For a mental health service, even the fact that you signed up is sensitive. Health data in the wrong hands can be used for targeted advertising, pressure or scams that reference your treatment.
The company's response
Cerebral notified HHS, the people affected and the media, and provided substitute notice on its website. It offered complimentary credit monitoring, revised its policies and procedures, retrained staff and added administrative and technical safeguards.
What it means for you
If you used Cerebral between 2019 and early 2023, read any notice you received. Credit monitoring helps if identity details were involved, but the larger issue here is privacy of health information, so be wary of messages that mention your treatment.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A freeze stops new credit being opened in your name and costs nothing. Place it with Equifax, Experian and TransUnion; the FTC explains how at consumer.ftc.gov. Lift it temporarily when you apply for credit yourself.
- 2
Read the notice letter and use the protection it offers
If a letter arrived, it lists what was exposed and often includes free credit monitoring or identity restoration with an enrollment deadline. Sign up before that date passes.
- 3
Watch your statements and credit reports
Check bank and card statements for charges you don't recognize, and pull your free credit reports at AnnualCreditReport.com. If something is wrong, report it at IdentityTheft.gov and follow the recovery plan it gives you.
- 4
Expect phishing that mentions the breach
Scammers use news of a breach to sound legitimate. Don't click links or call numbers in unexpected texts or emails about it. Contact the company through the phone number or site on your own card or statement.
- 5
Check whether your email or phone is in this and other breaches
Serus monitors breach databases and the dark web and alerts you when your details appear, with steps for each case. A free scan shows where you stand today.
Timeline
-
The breach happened
-
The company made it public
Frequently asked
Was I affected by this breach?
Check the notice letter you received. Organizations usually mail one to each person whose data was involved. If you have no letter and think your data was held, contact Cerebral using the details on its own website.
Should I freeze my credit?
If your Social Security number or similar ID details were exposed, the FTC says a credit freeze is a free way to block new accounts being opened in your name. Place it with Equifax, Experian and TransUnion.
What should I do if I get a message about the breach?
Treat it with care. Criminals send fake breach alerts. Go to the company's own site or the number on your statements instead of using a link or number in the message.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
