CHSPSC chs.net CHSPSC data breach: what happened and what to do
CHSPSC, which provides services to Community Health Systems hospitals and clinics, was hit through a flaw in Fortra's GoAnywhere file transfer software between January 28 and 30, 2023. Reports put the number of people affected between about 1 million and 1.2 million. Patient and some employee data was involved.
View all 13,177 breaches- Breach date
- 28 Jan 2023
- Made public
- 7 Mar 2023
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
CHSPSC, LLC provides services to hospitals and clinics affiliated with Community Health Systems. It was one of the organizations affected when attackers exploited a previously unknown flaw in GoAnywhere, a file transfer product from the vendor Fortra, between January 28 and January 30, 2023.
Timeline
Fortra took the affected systems offline on January 31, 2023, and notified CHSPSC on February 2. Notices to people began in March 2023, and the attorney general listings in California and Washington record the filing. CHSPSC offered identity theft protection services.
Who was affected
The personal and health information of patients of affiliated providers was involved, along with some employee data. HIPAA Journal reported up to about 1 million people. A Bloomberg Law report on a class action put the figure at nearly 1.2 million. The company's notice to each person says which details were involved for them.
What this means for you
The attack hit a vendor's file transfer tool, not a hospital's own network, so you may get a letter from CHSPSC even if you've never heard of it. Health and identity details, if included in your letter, are the kind criminals use for insurance fraud and new-account fraud. Read the explanation of benefits your insurer sends and question any care you didn't receive.
Sources checked: hipaajournal.com, news.bloomberglaw.com, consumer.ftc.gov
Last verified against the official page:
What to do if you were in it
- 1
Read your notice letter for what was taken
Your letter says which details of yours were involved. The steps below matter most if it lists a Social Security number, date of birth or health insurance details.
- 2
Freeze your credit if a Social Security number or ID was involved
A freeze is free and stops most new accounts in your name. The FTC explains how to place one at Equifax, Experian and TransUnion, each separately.
- 3
Take the free monitoring if you were offered it
The FTC recommends using the credit monitoring or identity protection a company offers after a breach. Use the enrollment code from your letter before it expires.
- 4
Expect phishing that mentions the breach
Scammers send emails, texts and calls that quote a real breach. Don't click links in them. Go to the company's site yourself or call the number on your letter.
- 5
Report misuse
If someone opens an account or files taxes in your name, report it at IdentityTheft.gov to get a recovery plan. You can also check whether your email or phone appears in other breaches with a free Serus scan.
- 6
Check your health insurance statements
Read each explanation of benefits your insurer sends. Contact the insurer if it lists care you didn't receive.
Frequently asked
Was I affected by the CHSPSC data breach?
You were told if you got a notice letter. CHSPSC serves Community Health Systems affiliates, so people who were patients or employees there around early 2023 may have been notified.
What caused the CHSPSC breach?
Attackers exploited a previously unknown flaw in Fortra's GoAnywhere file transfer software between January 28 and 30, 2023.
How many people were affected?
Reports differ: up to about 1 million per HIPAA Journal, and nearly 1.2 million per a Bloomberg Law report on a class action.
Should I freeze my credit?
If your letter mentions a Social Security number or other identity details, yes. A freeze is free.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
