Imperium Health imperiumhealth.com Imperium Health data breach: what happened and what to do
Imperium Health, a Kentucky firm that supports healthcare provider groups, reported in 2020 that a phishing attack on employee email affected 139,114 people. Names, dates of birth, Social Security numbers, addresses, driver's license numbers, financial information and treatment information were involved.
View all 13,177 breaches- Breach date
- 23 Apr 2020
- Made public
- 17 Aug 2020
- Affected
- 139,114
- Data exposed
- Names, Physical addresses, Dates of birth, Social security numbers, Driver's licenses, Financial information, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Imperium Health supports accountable care organizations, groups of healthcare providers that coordinate patient care. In 2020 it told the U.S. Department of Health and Human Services that several of its employees had fallen for an email phishing scheme. Phishing is a fake message built to trick someone into giving up a login. The emails put patient information held in those mailboxes at risk. The company learned of the phishing emails on April 23, 2020, and the HHS breach portal lists the case as reported in August 2020.
In total, 139,114 people were affected. Because Imperium worked on behalf of healthcare providers, it is listed as a business associate, the HIPAA term for a vendor that handles patient data for a provider.
Sources checked: ocrportal.hhs.gov, hipaajournal.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
According to the HHS entry, the information involved included:
- Names and addresses
- Dates of birth
- Social Security numbers
- Driver's license numbers
- Financial information
- Treatment information
That mix matters. A name, date of birth and Social Security number together are what criminals need to try opening credit or filing a tax return in someone else's name. Treatment details can make a scam message more believable, for example a fake call from your insurer or a clinic.
How the company responded
Imperium notified HHS, the people affected and the media. It offered one year of free credit monitoring and identity restoration services, added administrative and technical safeguards, and retrained employees on spotting fraudulent email. HHS's Office for Civil Rights recorded that the corrective actions were in place.
What this means for you
If you got a letter from Imperium Health or from your provider about this, treat it as real but check the sender before you reply to anything. If your Social Security number was included, a credit freeze is the strongest step the FTC describes.
What to do if you were in it
- 1
Read your notice and use the free services
Imperium offered one year of credit monitoring and identity restoration. If you got a letter, follow the sign-up steps in it, using the phone number or website printed there rather than links in an email or text.
- 2
Freeze your credit
Social Security numbers were involved, so the FTC recommends a credit freeze at Equifax, Experian and TransUnion. It's free and you can lift it when you need to apply for credit.
- 3
Read your insurance statements
Look through explanation of benefits statements and medical bills for services you didn't receive. Report anything unfamiliar to your insurer or provider.
- 4
Expect phishing that mentions your care
Treatment details can make a scam message look legitimate. Don't click links or give out details on an unexpected call, email or text. Contact the organization using a number you already trust.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you, and tells you what to do next.
Official filings
- U.S. Department of Health and Human Services , filed 17 Aug 2020 : 139,114 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Imperium Health breach?
139,114 people were affected. If you were, Imperium or your healthcare provider should have mailed you a notice. If you were treated by a provider group that works with Imperium and didn't get one, ask the provider directly.
What information was exposed?
HHS lists names, dates of birth, Social Security numbers, addresses, driver's license numbers, financial information and treatment information.
Was this a hack of Imperium's systems?
HHS describes it as a hacking or IT incident that started with employees falling for phishing emails.
Should I freeze my credit?
If your Social Security number was in your notice, yes. The FTC says a freeze is free and stops new accounts being opened with your information.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
