Chelan Douglas Health District cdhd.wa.gov Chelan Douglas Health District data breach: what happened and what to do
Chelan Douglas Health District in Washington reported a July 2021 cyberattack to HHS affecting 188,236 people. Exposed data included names, Social Security numbers, dates of birth, financial account details and treatment information.
View all 13,177 breaches- Breach date
- 2 Jul 2021
- Affected
- 188,236
- Data exposed
- Names, Dates of birth, Social security numbers, Financial account information, Treatment information, Health insurance information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Chelan Douglas Health District, the public health agency for two counties in Washington state, reported a cyberattack to the U.S. Department of Health and Human Services (HHS). A cybersecurity firm confirmed that unauthorized people were in the district's network between July 2 and July 4, 2021. The district said it wasn't a ransomware attack.
The district finished its investigation in February 2022 and began mailing notification letters on March 15, 2022. The HHS report lists 188,236 people. Early news coverage cited a lower figure of about 109,000, so go by the HHS count.
Sources checked: hipaajournal.com, ocrportal.hhs.gov, atg.wa.gov
Last verified against the official page:
What was exposed
According to the notice coverage, the review confirmed names, Social Security numbers, dates of birth or death, financial account information, treatment and diagnosis information, medical record or patient numbers, and health insurance policy details.
What that means for you
The mix matters. A name, date of birth and Social Security number together are what someone needs to apply for credit as you or file a fake tax return, and that kind of misuse can surface years later. Health insurance and treatment details feed convincing phone and email scams that pose as your insurer or a clinic.
The district reported adding administrative and technical safeguards. Washington's Attorney General also lists the breach. If you got a letter, it's the most reliable source for what applies to you, and it explains what credit monitoring the district offers.
What to do if you were in it
- 1
Freeze your credit
If your Social Security number or date of birth was involved, place a free credit freeze at Equifax, Experian and TransUnion. The FTC explains how. A freeze blocks most new accounts opened in your name and you can lift it whenever you apply for credit.
- 2
Watch your bank account and ask about a new one
Check statements for payments you didn't make. If your bank account number was exposed, ask your bank whether to close the account and open a new one.
- 3
Read your insurance statements
Check each explanation of benefits for care you didn't receive and report anything odd to your insurer.
- 4
Expect messages that mention the breach
Callers and emails that quote your health plan or a clinic visit are the likeliest follow-up. Don't click links or call numbers in them. Go to the company's own website instead, as the FTC advises.
- 5
Report misuse
If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
- 6
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus keeps watching and alerts you when they show up in a new leak.
Official filings
- U.S. Department of Health and Human Services , filed 15 Mar 2022 : 188,236 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
How many people were affected?
The HHS breach report lists 188,236 people. Some early news reports said about 109,000.
What was exposed?
Names, Social Security numbers, dates of birth or death, financial account information, treatment and diagnosis details, medical record numbers and health insurance policy information.
Was it ransomware?
A representative of the health district said it was not a ransomware attack. A cybersecurity firm confirmed unauthorized access to the network on July 2 to 4, 2021.
Should I freeze my credit?
If you got a notice, yes: your Social Security number was among the data. A freeze is free at Equifax, Experian and TransUnion, per the FTC.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
