Electromed electromed.com Electromed data breach: what happened and what to do
Electromed, a maker of respiratory care devices, found unauthorized access to its files on June 16, 2021. It reported 47,200 people affected to HHS in August 2021. Exposed data included names, addresses, medical and health insurance information, and for employees Social Security numbers.
View all 13,177 breaches- Breach date
- 16 Jun 2021
- Made public
- 9 Aug 2021
- Affected
- 47,200
- Data exposed
- Names, Physical addresses, Medical information, Health insurance information, Social security numbers, Driver's licenses, Bank account numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Electromed, a Minnesota maker of respiratory care devices, found on June 16, 2021 that an unauthorized party had gotten into a limited number of its files. The company hired outside cybersecurity experts to investigate. Its report to the U.S. Department of Health and Human Services (HHS), filed on August 9, 2021, lists 47,200 people affected. HHS describes the incident as a ransomware attack.
Sources checked: sec.gov, smartvest.com, healthitsecurity.com
Last verified against the official page:
What was exposed
For customers, the files held names, mailing addresses, medical information and health insurance information. For employees, the notice says Social Security numbers, driver's license numbers and financial account information may also have been accessed. Which items applied to you depended on whether you were a customer or an employee, so the letter you received is the best guide.
Health insurance details and a date of service are enough for someone to bill a plan in your name, or to write a phishing message that sounds like your provider. A Social Security number or a driver's license number is the kind of data used to open credit in someone else's name, sometimes long after the breach.
The company's response
Electromed said it had received no reports of identity theft linked to the incident. It offered complimentary credit monitoring and identity theft protection to the people involved, and set up a call center for questions. It also told HHS it added administrative, technical and security safeguards and retrained staff.
What to do if you got a notice
Read the letter for the exact list of what was taken about you, then follow the steps below. If you were offered free credit monitoring, the FTC says it is worth taking. If a Social Security number was involved, a credit freeze is the strongest step, and it costs nothing.
What to do if you were in it
- 1
Read your notice letter
It lists what was exposed about you. Whether you were a customer or an employee changes the list, so check it before deciding how far to go.
- 2
Take the free credit monitoring if you were offered it
The FTC recommends accepting free credit monitoring that a company offers after a breach. Use the enrollment instructions in your letter.
- 3
Freeze your credit if a Social Security number or driver's license number was involved
A freeze is free and you place it separately at Equifax, Experian and TransUnion, according to the FTC. You can lift it temporarily when you apply for credit.
- 4
Check your insurance statements
Read each explanation of benefits and call your insurer about any service you didn't receive. The FTC's identity theft guidance covers medical identity theft too: see identitytheft.gov.
- 5
Expect phishing that mentions the breach
Names, addresses and insurance details make a convincing fake message. Don't click links in unexpected emails or texts about your health coverage; contact the company using a number you already trust.
- 6
Check whether your email or phone is in this and other breaches
A free Serus scan checks your email and phone against breach databases, so you know what else to act on.
Official filings
- U.S. Department of Health and Human Services , filed 9 Aug 2021 : 47,200 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Electromed breach?
If you received a notice letter from Electromed, yes. HHS lists 47,200 people in total, covering customers and employees.
What data was exposed?
Customer files included names, mailing addresses, medical information and health insurance information. For employees, Social Security numbers, driver's license numbers and financial account information may also have been accessed.
Is there a settlement?
Press reports describe a class action settlement in Lutz v. Electromed, filed in federal court in Minnesota, but the reported amount differs between outlets. Check the official settlement notice for current terms.
Should I change my password?
The notice doesn't mention passwords being taken. Changing passwords isn't required for this breach, but it's good practice if you reuse them.
Sources
- sec.gov/Archives/edgar/data/1488917/000089710121000674/elmd211008_99-2.htm
- smartvest.com/website-notice/
- healthitsecurity.com/news/electromed-data-breach-impacting-customers-staffers-phi
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
