City of Hope cityofhope.org City of Hope data breach: what happened and what to do
City of Hope, a US cancer center, said attackers accessed its systems between September 19 and October 12, 2023. About 827,000 people were affected. Exposed data may include names, dates of birth, Social Security numbers, health insurance details and medical records.
View all 13,115 breaches- Breach date
- 19 Sept 2023
- Made public
- 2 Apr 2024
- Affected
- 827,149
- Data exposed
- Names, Dates of birth, Social security numbers, Health insurance information, Medical records
- Last updated
What happened
City of Hope, a cancer treatment and research center based in California, said it noticed suspicious activity on its systems on October 13, 2023. An investigation found that an unauthorized party had access between September 19 and October 12, 2023. The center posted its public notice on April 2, 2024, and told the Maine Attorney General that 827,149 people were affected. State attorney general breach lists in California and Washington also carry the notice, but those pages show only one state's residents, so 827,149 is the national figure.
The center has not said what kind of attack it was, and no ransomware group has claimed it.
What was exposed
Not every person had every type of data taken. The information that may have been exposed includes names, contact details, dates of birth, Social Security numbers, financial details, health insurance information and medical records. City of Hope said it had no evidence of identity theft or fraud as a result.
What it means for you
The Social Security number and date of birth are the dangerous pair. With them a criminal can apply for credit, file a tax return in your name, or open accounts that don't show up for months. Insurance details and medical records add a second kind of fraud: someone using your coverage for care you didn't get, or a scammer who knows enough about your treatment to sound like your provider.
The company's response
City of Hope offered two years of complimentary credit monitoring through Kroll to affected people and said it added further safeguards to its systems. If you received a letter, it contains the enrollment code and deadline.
What to do
Freeze your credit at Equifax, Experian and TransUnion. A freeze is free and blocks most new accounts. Read your insurer's explanation of benefits statements for treatment you didn't receive, and use the credit monitoring if you were offered it.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
Place a free credit freeze at Equifax, Experian and TransUnion. It blocks most new accounts in your name, and you can lift it when you apply for credit yourself.
- 2
Enroll in the credit monitoring if you got a letter
City of Hope offered two years through Kroll. Use the code in your notice before the deadline.
- 3
Read your insurance statements
Check every explanation of benefits for care you didn't receive and report anything odd to your insurer.
- 4
Watch for calls and messages about your care
Scammers who know you were a patient can pose as the hospital or an insurer. Hang up and call the number on your card or bill.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your details and alerts you when they show up in a new leak, so you know when to repeat these steps.
Frequently asked
Was I affected by the City of Hope breach?
About 827,000 people received notices. If you were a City of Hope patient or had records with them and got a letter, you were affected. If you're unsure, contact the center using the number on its website or a past bill.
What data was exposed?
Names, contact details, dates of birth, Social Security numbers, financial details, health insurance information and medical records, varying by person.
Is credit monitoring available?
Yes. City of Hope offered two years of complimentary credit monitoring through Kroll to affected people.
How many people were affected?
827,149 people, according to the center's disclosure to the Maine Attorney General.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
