Horizon Actuarial Services, LLC horizonactuarial.com Horizon Actuarial Services data breach: what happened and what to do
Horizon Actuarial Services, an actuarial firm that works for health plans, was hit by ransomware in November 2021. It reported to HHS that the health information of 227,953 people was involved, including Social Security numbers, dates of birth and diagnoses.
View all 13,177 breaches- Breach date
- 10 Nov 2021
- Affected
- 227,953
- Data exposed
- Names, Dates of birth, Social security numbers, Financial information, Claims information, Diagnoses
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Horizon Actuarial Services, LLC provides actuarial work to health and benefit plans, so it holds plan members' data on behalf of other organizations. Its own investigation found that someone had unauthorized access to two of its servers on November 10 and 11, 2021. It was a ransomware attack, and Horizon reported to the U.S. Department of Health and Human Services that it compromised the protected health information of 227,953 individuals.
HIPAA Journal reports that Horizon negotiated with the attacker and paid to prevent the stolen data from being sold, published or misused. Horizon didn't disclose the amount.
Sources checked: ocrportal.hhs.gov, hipaajournal.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
Per the HHS entry, the information included names, dates of birth, Social Security numbers, claims and financial information, and diagnoses. A Social Security number with a date of birth is enough to open credit in your name. Claims and diagnosis details can also be used in medical identity fraud or in phishing that sounds like it comes from your health plan.
The company's response
Horizon notified HHS, affected individuals and the media, and posted a notice on its website. It offered free credit monitoring and added administrative and technical safeguards. Horizon later proposed an $8.73 million settlement of a class action over the incident, without admitting wrongdoing, according to HIPAA Journal.
What to do if you were in it
- 1
Use the free credit monitoring if you got a letter
Enroll using the instructions in your notice. The FTC recommends taking credit monitoring a company offers after a breach.
- 2
Freeze your credit
A credit freeze is free and stops lenders from seeing your report, which blocks most new accounts in your name. Place it separately at Equifax, Experian and TransUnion. Lift it when you apply for credit yourself.
- 3
Read your explanation of benefits statements
Question any treatment, claim or provider you don't recognize with your health plan, and report it as possible medical identity theft.
- 4
Be wary of messages that mention your plan or the breach
Don't click links in unexpected emails or texts. Contact your plan using the number on your member card.
- 5
Report misuse
If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
- 6
Check what else is out there
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your details show up. It can't remove breach data, so the steps above are what protect you.
Official filings
- U.S. Department of Health and Human Services , filed 9 Mar 2022 : 227,953 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Horizon Actuarial Services breach?
Horizon says it notified affected people. Because it worked for health plans, the letter may be the first time you heard of the company. Your plan or employer benefits office can tell you whether Horizon handled your data.
What was exposed?
According to HHS, names, dates of birth, Social Security numbers, claims and financial information, and diagnoses.
Is there a settlement?
Horizon proposed an $8.73 million settlement of a class action, according to HIPAA Journal. Check the settlement notice for who qualifies and the deadlines.
Should I freeze my credit?
Yes, if your Social Security number was involved. A freeze is free and you can lift it any time.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
