Hospital Sisters Health System hshs.org Hospital Sisters Health System data breach: what happened and what to do
Attackers were inside the Hospital Sisters Health System (HSHS) network from August 16 to August 27, 2023. HSHS later reported 882,782 people affected. Data included names, dates of birth, treatment and insurance details, and for some people Social Security numbers.
View all 13,115 breaches- Breach date
- 16 Aug 2023
- Affected
- 882,782
- Data exposed
- Names, Physical addresses, Dates of birth, Medical record numbers, Treatment information, Health insurance information, Social security numbers, Driver's licenses
- Last updated
What happened
Hospital Sisters Health System (HSHS) runs hospitals and clinics in Illinois and Wisconsin. On August 27, 2023, a cyberattack took down its systems and phones, and the outage lasted for days. HSHS later said an unauthorized party had access to its network from August 16 to August 27, 2023.
HSHS first reported the breach to HHS with a placeholder count of 500 people. In its filing with the Maine Attorney General it gave the total as 882,782 people, 79 of them in Maine. Individual letters went out in rolling batches starting in late August 2024, a year after the attack, once HSHS had worked out who was involved.
A count of 662 you may see in Washington State's list is only the Washington residents. The total is 882,782.
What was exposed
HSHS says the data differed by person. It could include names, addresses, dates of birth, medical record numbers, treatment information, health insurance information, Social Security numbers and driver's license numbers.
Medical and insurance details are useful to criminals for medical identity fraud, and an SSN with a date of birth is enough to apply for credit. Patients should also know that scammers posed as HSHS staff to ask for payment after the attack.
The company's response
HSHS offered free identity theft protection and credit monitoring to affected people and posted updates on its incident page. A proposed class action was filed in an Illinois federal court. Check the letter you received for the enrollment code and deadline.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A freeze stops new credit being opened in your name. It is free at Equifax, Experian and TransUnion. The FTC explains how it works and how to lift it when you need credit.
- 2
Use the free credit monitoring if it is offered
HSHS offered free identity theft protection and credit monitoring. Use the enrollment code in your letter and note the deadline.
- 3
Read your statements and explanation of benefits
Look for accounts, charges or medical bills you don't recognize, and report them to the company right away.
- 4
Expect phishing that quotes real details
Scammers use leaked names and addresses to sound legitimate. Don't give out your Social Security number or card details to anyone who contacts you first.
- 5
Check whether your email or phone is in this and other breaches
Serus monitors breach databases and the dark web and alerts you when your email, passwords or other personal data appear, and tells you what to do next. It can't remove data that has already leaked, so the alert is the point: it tells you which passwords to change. You can run a free scan.
Frequently asked
Was I affected by the HSHS data breach?
If you were a patient or employee of an HSHS hospital or clinic and got a notice letter, you were among the 882,782 people reported. Letters went out from August 2024.
What was exposed?
It varied. HSHS lists names, addresses, dates of birth, medical record numbers, treatment and health insurance information, Social Security numbers and driver's license numbers.
Is the 662 number the total?
No. 662 is the count of Washington residents in that state's list. The total HSHS reported is 882,782.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
