Gryphon Healthcare data breach: what happened and what to do

What happened

Gryphon Healthcare is a medical billing company in Texas. It handles billing and revenue cycle work for healthcare providers, which means it holds patient records on their behalf. In August 2024 it found that an unauthorized party had reached data tied to one of its partners, a provider it does billing for. Gryphon has not named that partner.

The U.S. Department of Health and Human Services (HHS) lists the breach as affecting 393,358 people and gives July 6, 2024 as the date it began. Gryphon says it detected the incident on August 13, 2024 and finished reviewing the affected data on September 3. HHS describes it as a ransomware incident at a partner. News coverage of Gryphon's filing with the Maine Attorney General reports a hacking incident, and no group has been reported as claiming it. Notification letters went out in October 2024.

What was exposed

HHS describes the data as clinical and demographic information. Coverage of Gryphon's notice lists more detail: names, dates of birth, addresses, Social Security numbers, dates of service, diagnosis information, health insurance information, medical treatment information, prescription information, provider information and medical record numbers. Not every person had every item exposed, and the notice tells each person which of their details were involved.

What that lets criminals do

A Social Security number with a name, date of birth and address is the core kit for identity theft. It can be used to apply for credit cards or loans, file a fake tax return, or open a phone account in your name. These crimes often show up months or years later, so a quiet first year doesn't mean you're in the clear.

Health details work differently. Diagnosis, prescription and insurance information gives scammers material for convincing phishing calls and texts ("we're calling about your recent prescription") and can be used for medical identity theft, where someone uses your insurance to get care or bill claims. Unlike a password, none of this can be changed.

The company's response

Gryphon offered everyone affected 12 months of complimentary credit monitoring and identity protection. HHS says Gryphon also added administrative, technical and security safeguards and retrained its workforce, and posted a notice on its website.

What to do if you got a letter

If you received a notice, you were one of the people whose data was involved. The steps below are in order of how much they protect you. Freezing your credit is the most useful one, because it blocks new accounts opened with your Social Security number, costs nothing, and you can lift it whenever you apply for credit yourself.

Take the credit monitoring if you want it. It tells you about new activity but doesn't stop it, so use it alongside a freeze, not instead of one. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they appear in a new leak. It can't remove data from a breach, so the practical protection is the steps below.