Fred Hutchinson Cancer Center fredhutch.org Fred Hutchinson Cancer Center data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Fred Hutchinson Cancer Center in Seattle detected unauthorized activity on its clinical network on 19 November 2023. Some patients then received extortion emails. The center hasn't confirmed what was taken or how many people are affected.
View all 13,118 breaches- Breach date
- 27 Oct 2023
- Made public
- 29 Feb 2024
- Last updated
What happened
Fred Hutchinson Cancer Center (Fred Hutch) is a cancer research and treatment center in Seattle. On 19 November 2023 it detected unauthorized activity on its clinical network. The network also holds some data for University of Washington Medicine patients, including people who were never seen at Fred Hutch.
The center took the clinical network offline within 72 hours, notified federal law enforcement and brought in an outside security firm. Its public FAQ encouraged patients to watch their bank statements and credit reports.
In early December 2023, patients began receiving emails that demanded payment and threatened to sell their data. The emails claimed to hold information on 800,000 patients, including names, Social Security numbers, medical and insurance details and lab results. Fred Hutch said it could not confirm what had been compromised or how many people were involved, and it told patients not to pay. Local reporting said about 300 patients had called the center about such emails by early December.
In February 2024 the breach appeared in the Washington Attorney General's notifications, which count 14,898 Washington residents. That is one state's figure and not a total for the incident.
What to do about a claim you can't verify
The 800,000 figure and the data types come from the extortion emails, not from the center's own findings. Treat them as a warning, not as a confirmed list. Medical and insurance details are worth guarding either way: a threatening email that quotes your diagnosis or treatment is a scam to pressure you, and paying doesn't remove anything.
Sources checked: kuow.org, bleepingcomputer.com, atg.wa.gov
Last verified against the official page:
What to do if you were in it
- 1
Don't pay anyone who emails you a threat
Fred Hutch told patients not to pay. Payment doesn't guarantee that the sender deletes anything. Forward the email to the center and report it at ic3.gov.
- 2
Freeze your credit at all three bureaus
If your Social Security number may have been in the data, a free freeze at Equifax, Experian and TransUnion blocks new accounts in your name.
- 3
Check your insurance statements
Read each explanation of benefits and look for care you didn't receive. Report anything odd to your insurer.
- 4
Expect scams that mention your care
Messages that quote your doctor, appointment or lab result are designed to rattle you. Call the center on the number from its website, not the one in the message.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at Serus to see which breaches include your email or phone.
Official filings
- Washington Attorney General , filed 29 Feb 2024 : 14,898 people
- U.S. Department of Health and Human Services , filed 22 Dec 2023 : 1,840,927 people
- Oregon Department of Justice , filed 22 Dec 2023
- Oregon Department of Justice , filed 21 Oct 2022
- U.S. Department of Health and Human Services , filed 25 May 2022 : 89,111 people
Timeline
-
Reported to U.S. Department of Health and Human Services
-
Reported to the Oregon Department of Justice
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
-
Reported to the Oregon Department of Justice
-
The company made it public
-
Reported to the Washington Attorney General
Frequently asked
Was I affected by the Fred Hutch breach?
If you were a Fred Hutch or UW Medicine patient served by the shared clinical network, possibly. Patients who got an extortion email were clearly targeted. The center hasn't published a full list of affected people in the sources used here.
What was exposed?
The center hasn't confirmed which data was taken. The extortion emails claimed names, Social Security numbers, medical and insurance details and lab results.
How many people were affected?
No confirmed total. The emails claimed 800,000 patients, and Washington's notice counts 14,898 residents of that state alone.
Should I change my password?
Passwords weren't named in what was reported. Changing your patient portal password and turning on two-factor login is cheap protection, and a credit freeze matters more.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
