Comstar data breach: what happened and what to do

Comstar, an ambulance billing company, was hit by ransomware that began on March 19, 2022. HHS says the health information of 585,621 people was affected, including names, dates of birth, medication and insurance information and Social Security numbers. Comstar later settled with HHS and two states.

View all 13,177 breaches

Breach date: 19 Mar 2022
Affected: 585,621
Data exposed: Names, Dates of birth, Social security numbers, Medical information, Medications, Health insurance information
Last updated: 29 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

Comstar, LLC is a Massachusetts company that handles billing for ambulance services. According to HHS, an unknown actor gained access to its network servers on March 19, 2022, and the intrusion was found on March 26. Ransomware encrypted the servers. HHS says the health information of 585,621 people was affected.

Comstar's first report to HHS gave a much lower number, 68,957, and later filings and the HHS settlement use 585,621.

Sources checked: ocrportal.hhs.gov, hhs.gov, hipaajournal.com

Last verified against the official page: 29 Oct 2026

How we research this Report an error

What was exposed

HHS describes clinical, demographic and financial information. HIPAA Journal's report on the settlement adds names, dates of birth, medical assessment and medication information, health insurance information and Social Security numbers. What was exposed varied by person.

If you were taken to hospital by an ambulance service that uses Comstar for billing, your details may be in these files even if you never dealt with Comstar itself.

The company's response

Comstar notified HHS, the people affected and the media, and offered 12 months of credit monitoring. It added administrative, technical and security safeguards and retrained staff.

HHS's Office for Civil Rights settled with Comstar for $75,000 and a two-year corrective action plan. Connecticut and Massachusetts separately settled with it for $515,000.

What to do if you were in it

1

Read the notice letter

If you were affected you should get a letter from the organization. It says which of your details were involved and whether it offers free credit monitoring. The FTC recommends taking that offer.
2

Freeze your credit

Because Social Security numbers were involved, place a free credit freeze at Equifax, Experian and TransUnion. The FTC explains how. Check your reports at annualcreditreport.com.
3

Read your health insurance statements

Look at explanation of benefits statements for treatment or claims you don't recognize, and tell your insurer if something is wrong.
4

Treat messages about the breach as suspect

Expect calls, texts and emails that use real details. Don't click links or give details to someone who contacts you first; contact the organization using a number from its own website.
5

Report misuse

If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
6

Check whether your email or phone is in this and other breaches

Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus alerts you when they show up in a new leak.

Official filings

U.S. Department of Health and Human Services , filed 26 May 2022 : 585,621 people

Timeline

19 Mar 2022
The breach happened
26 May 2022
Reported to U.S. Department of Health and Human Services

Frequently asked

Was I affected by the Comstar data breach?

The organization sent letters to the people whose details were involved. If you were a patient and got no letter, contact it directly using the contact details on its own website.

What was exposed?

Clinical, demographic and financial information, according to HHS. HIPAA Journal's report adds names, dates of birth, medication and health insurance information and Social Security numbers.

Should I freeze my credit?

If your Social Security number was exposed, a freeze is a sensible step. It's free, you set it up at each of the three bureaus, and you can lift it when you need to apply for credit.

Was there a settlement?

Yes. HHS's Office for Civil Rights settled with Comstar for $75,000 and a corrective action plan, and Connecticut and Massachusetts reached a $515,000 settlement with it, according to news reports. Those reports don't describe payments to affected people.