DuPage Medical Group dupagemd.com DuPage Medical Group data breach 2021: what happened and what to do
DuPage Medical Group, an Illinois physician group, reported a cyberattack that began on July 12, 2021 and affected 655,384 people. Names, addresses, dates of birth, diagnoses and treatment details were exposed. Social Security numbers were exposed for some patients.
View all 13,177 breaches- Breach date
- 12 Jul 2021
- Affected
- 655,384
- Data exposed
- Names, Addresses, Dates of birth, Social security numbers, Diagnoses, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
DuPage Medical Group is the largest independent physician group in Illinois. Unauthorized people got into its systems on July 12, 2021, and the group detected the intrusion and secured its network the next day. On August 17, 2021, it confirmed that files holding patient information were potentially affected. Notification letters started going out in late August.
The group reported the incident to the US Department of Health and Human Services (HHS) as a cyberattack affecting 655,384 people.
Sources checked: ocrportal.hhs.gov, hipaajournal.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
HHS lists names, addresses, dates of birth, Social Security numbers, diagnoses and other treatment information. According to HIPAA Journal, Social Security numbers were involved for only a small share of patients, and the group said financial account numbers were not affected.
A name, address and date of birth are enough for a convincing phishing call or text that mentions your doctor. A Social Security number, where it was exposed, is what lets someone apply for credit in your name. Diagnoses and treatment details can also be used for medical identity theft or to make a scam message sound legitimate.
The company's response
DuPage Medical Group told HHS it offered complimentary credit monitoring and added administrative, technical and security safeguards. A class action over the incident was filed in DuPage County in September 2021.
What to do if you were in it
- 1
Be wary of messages that mention the breach
Scammers use real details to sound credible. Don't click links or call numbers in unexpected texts, emails or calls about your care or the breach. Go to the organization's own website instead. If you spot a scam, report it at IdentityTheft.gov.
- 2
Freeze your credit at all three bureaus
A credit freeze is free and stops lenders from opening new accounts in your name. Place one at Equifax, Experian and TransUnion, as the FTC explains. Do this first if your letter says your Social Security number was involved.
- 3
Read your insurance and medical statements
Check the statements from your health insurer and your doctors. Report treatment, claims or bills you don't recognize to the insurer, since someone may be using your details to get care.
- 4
Use the free credit monitoring if you were offered it
The notice letter explains how to enrol, and there is a deadline. The FTC recommends taking free credit monitoring when a company offers it. Enrolment is separate from a freeze, so do both.
- 5
Check whether your email or phone is in other breaches
Serus monitors breach databases and the dark web and alerts you when your details show up. Run a free scan to see where you stand. Our guide to what to do after a data breach covers the rest.
Official filings
- U.S. Department of Health and Human Services , filed 30 Aug 2021 : 655,384 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the DuPage Medical Group breach?
The notice letter is the reliable answer. Letters went to the 655,384 people HHS lists. If you were a patient and didn't get one, contact the group using the number on its website.
Were Social Security numbers exposed?
For some people, yes. HIPAA Journal reports that Social Security numbers were involved for a small share of patients. Your letter says which of your details were affected.
Should I freeze my credit?
The FTC says a credit freeze is free and blocks most new accounts in your name. If your letter lists a Social Security number, it is a sensible step.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- hipaajournal.com/600000-dupage-medical-group-patients-notified-about-phi-breach/
- hipaajournal.com/patients-sue-dupage-medical-group-over-july-2021-ransomware-attack/
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
