Fitzgibbon Hospital fitzgibbon.org Fitzgibbon Hospital data breach: what happened and what to do
Fitzgibbon Hospital in Marshall, Missouri reported a cyberattack to HHS in December 2022 that affected the health information of 112,072 people. Exposed data included names, addresses, dates of birth, driver's license and Social Security numbers, and treatment and financial information.
View all 13,177 breaches- Breach date
- 30 Dec 2022
- Made public
- 30 Dec 2022
- Affected
- 112,072
- Data exposed
- Names, Physical addresses, Dates of birth, Driver's licenses, Social security numbers, Treatment information, Financial information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Fitzgibbon Hospital, a community hospital in Marshall, Missouri, told the U.S. Department of Health and Human Services (HHS) that it had a cyberattack that compromised the protected health information of 112,072 people. HHS lists the cause as a hacking or IT incident. The hospital began notifying patients on December 30, 2022.
According to HHS's case summary, the hospital told HHS, affected individuals and the media, and posted a notice on its website. It offered free credit monitoring and added administrative, technical and security safeguards.
Sources checked: ocrportal.hhs.gov, hipaajournal.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
HHS says the information involved included:
- names and addresses
- dates of birth
- driver's license numbers and Social Security numbers
- claims and financial information
- diagnoses, medications and other treatment information
Which of these applied to you depends on your relationship with the hospital. The notice letter you received is the place to check.
What this lets criminals do
A Social Security number plus a date of birth and a home address is what someone needs to open credit in your name or file a fake tax return, and that can happen months after the breach. Treatment details and insurance information also make phishing calls and texts more convincing: a message that names your hospital or a real medication looks legitimate. Medical details can also be used for medical identity theft, where someone gets care or bills your insurer under your name.
What to do now
If you got a letter from Fitzgibbon Hospital, take the credit monitoring it offers and freeze your credit. The FTC explains how a freeze works and says it's free. Then read the explanation of benefits statements your insurer sends and question anything you didn't receive. Serus can't remove data from a breach, but it monitors breach databases and the dark web for your details and alerts you when they appear.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
Your Social Security number and date of birth were involved, so ask Equifax, Experian and TransUnion each for a credit freeze. The FTC says a freeze is free and stays in place until you lift it.
- 2
Use the free credit monitoring if you were offered it
The hospital said it offered complimentary credit monitoring. Your notice letter explains how to sign up and by when.
- 3
Check your insurance statements
Read each explanation of benefits your insurer sends. Report any treatment, prescription or bill you don't recognize to your insurer.
- 4
Expect phishing that mentions the hospital
Calls, texts and emails that mention Fitzgibbon Hospital, your care or your insurer may be scams. Don't click links or give details. Contact the hospital or insurer using a number from its official website.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see whether your email address or phone number shows up in known breaches.
Official filings
- U.S. Department of Health and Human Services , filed 30 Dec 2022 : 112,072 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Fitzgibbon Hospital data breach?
Fitzgibbon Hospital reported to HHS that 112,072 people were affected and sent notification letters starting December 30, 2022. If you received a letter, you were affected. If you were a patient and didn't, ask the hospital.
What information was exposed?
HHS lists names, addresses, dates of birth, driver's license and Social Security numbers, claims and financial information, diagnoses, medications and other treatment information.
Should I freeze my credit?
Social Security numbers were involved, so yes, it's a sensible step. The FTC says a credit freeze is free and you place it at each of Equifax, Experian and TransUnion.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
