Geisinger geisinger.org Geisinger data breach: what happened and what to do
Geisinger reported that a former employee of its vendor Nuance accessed records on 1,276,026 patients, discovered in November 2023. Exposed details included names, birth dates, addresses and medical record numbers, but not Social Security numbers.
View all 13,115 breaches- Breach date
- Nov 2023
- Made public
- 21 Jun 2024
- Affected
- 1,276,026
- Data exposed
- Names, Dates of birth, Physical addresses, Medical record numbers
- Last updated
Geisinger, a Pennsylvania health system, reported that a former employee of its business associate Nuance Communications accessed patient information. The US Department of Health and Human Services lists 1,276,026 people affected, and the breach appeared on its public list on June 21, 2024.
What happened
Geisinger found the access in November 2023. According to Healthcare Dive, the former employee got in two days after being terminated. Nuance cut off the access and told law enforcement. Patients were not told right away: notices were delayed at the request of law enforcement, to protect the investigation, and went out months later. The former employee was arrested and faces federal charges. They haven't been convicted.
What was exposed
Reported details include names, birth dates, addresses and medical record numbers. According to Healthcare Dive, no claims or insurance information, financial information or Social Security numbers were accessed.
That's less than in many breaches, but it isn't harmless. A name, address and date of birth, tied to a real health provider, make phishing messages much more convincing. Scammers can pose as the hospital or your insurer and sound like they know you.
The company's response
HHS records that Geisinger added administrative, technical and security safeguards. A class action lawsuit has reportedly been filed against Geisinger.
What to do if you were in it
- 1
Expect scams that mention the breach
Emails, texts and calls that quote real details about you, or offer help with the breach, are a common follow-up. Don't click links in them. Go to the company's own site or phone number instead.
- 2
Be wary of calls from 'the hospital' or 'your insurer'
Hang up and call the number on your card or on Geisinger's website before you share anything.
- 3
Watch your statements and explanations of benefits
Read the explanations of benefits your insurer sends. Question any care you didn't receive.
- 4
Consider a credit freeze
Social Security numbers weren't reported as exposed, but a name and date of birth are enough for some fraud. A freeze is free at Equifax, Experian and TransUnion. See the FTC's guide.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your details and alerts you when they show up in a new leak.
Frequently asked
Was I affected by the Geisinger breach?
Geisinger notified affected patients. If you've been a Geisinger patient, look for that letter.
What was exposed?
Names, birth dates, addresses and medical record numbers. Reports say Social Security numbers, financial information and insurance claims were not accessed.
Who accessed the data?
A former employee of Geisinger's vendor Nuance Communications, according to Geisinger's report. The person was arrested and faces federal charges but hasn't been convicted.
Is there a lawsuit?
A class action has reportedly been filed.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
