EmergeOrtho emergeortho.com EmergeOrtho data breach: what happened and what to do
EmergeOrtho, a North Carolina orthopedic practice, was hit by ransomware in May 2022. HHS lists 68,661 people affected. Exposed data included names, addresses, dates of birth, Social Security numbers, driver's license numbers and treatment information.
View all 13,177 breaches- Breach date
- 18 May 2022
- Made public
- 25 Aug 2022
- Affected
- 68,661
- Data exposed
- Names, Physical addresses, Dates of birth, Driver's licenses, Social security numbers, Medical information, Financial information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
EmergeOrtho said it discovered and blocked a ransomware attack on its systems on May 18, 2022. The practice sent notices to patients in August 2022, and in late August it reported the breach to the U.S. Department of Health and Human Services (HHS). The HHS breach portal lists 68,661 people affected.
EmergeOrtho has not said whether data was copied out of its systems, only that patient information was accessed.
Sources checked: ocrportal.hhs.gov, hipaajournal.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
Per HHS, the information involved included names, addresses, dates of birth, driver's license numbers, Social Security numbers, diagnoses, and other treatment and financial information.
That mix matters. A name, date of birth and Social Security number are what criminals need to open credit in your name, so a credit freeze is the main protection. Treatment details can feed convincing phishing calls that pretend to be your doctor's office or insurer.
The company's response
HHS reports that EmergeOrtho revised its security policies and procedures, strengthened its technical safeguards and offered complimentary credit monitoring to affected people. It notified HHS, affected individuals and the media, and provided substitute notice. A class action over the incident was filed in September 2022.
If you were an EmergeOrtho patient and got a letter, it's real enough to act on. If you didn't get one, you can contact the practice directly to ask whether your records were involved.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A credit freeze is free and stops anyone from opening new credit in your name. Set it up with Equifax, Experian and TransUnion. The FTC explains how: https://consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- 2
Watch your statements and credit reports
Check your accounts for charges you don't recognize and pull your free reports at annualcreditreport.com. If something is wrong, report it at identitytheft.gov and follow the recovery plan it gives you.
- 3
Use the credit monitoring if you were offered it
If your notice letter includes free credit monitoring, sign up using the instructions in the letter, not a link someone sent you.
- 4
Expect phishing that mentions the breach
Scammers use real breach news to sound legitimate. Don't click links or call numbers in unexpected texts, emails or calls. Go to the company's own site or the number on your card or statement. Report scams at reportfraud.ftc.gov.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases and the dark web for your email, phone and other details, and Serus keeps watching and alerts you if something new turns up.
Official filings
- U.S. Department of Health and Human Services , filed 25 Aug 2022 : 68,661 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the EmergeOrtho breach?
EmergeOrtho notified affected patients by letter. HHS lists 68,661 people. If you were a patient and didn't get a letter, ask the practice directly.
What data was exposed in the EmergeOrtho breach?
According to HHS: names, addresses, dates of birth, driver's license numbers, Social Security numbers, diagnoses, and other treatment and financial information.
Should I freeze my credit after the EmergeOrtho breach?
Yes, because Social Security numbers were involved. The FTC says a credit freeze is free and prevents new accounts being opened in your name.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
