INTEGRIS Health integrishealth.org INTEGRIS Health data breach: what happened and what to do
INTEGRIS Health, an Oklahoma health system, reported that a November 2023 attack exposed data on 2,385,646 people. Notices list names, dates of birth, contact details and Social Security numbers.
View all 13,115 breaches- Breach date
- 27 Nov 2023
- Made public
- 26 Jan 2024
- Affected
- 2,385,646
- Data exposed
- Names, Dates of birth, Contact information, Social security numbers
- Last updated
What happened
INTEGRIS Health, a health system in Oklahoma, told HHS that 2,385,646 people were affected by a cyberattack. The California Attorney General's listing dates the breach to 27 November 2023. Law-firm and state filings put the access on 27 or 28 November, and INTEGRIS notified people from late December 2023.
Patients also got extortion emails before the official notice. The attacker told BleepingComputer that it only stole data and did not encrypt files, according to press coverage.
What was exposed
Notices describe a name, date of birth, contact information, demographic information and a Social Security number. A later notice in March 2024 covered patients of INTEGRIS's community hospitals, which it supports with electronic health record services.
Name, date of birth and Social Security number together are what a criminal needs to apply for credit as you. Extortion emails add another risk: messages demanding payment to keep your data private. INTEGRIS didn't ask anyone to pay.
What it means for you
Don't pay anyone who emails you about this breach. Freeze your credit, take any monitoring INTEGRIS offered in your letter and treat unexpected messages as suspect.
What to do if you were in it
- 1
Freeze your credit
Place a free credit freeze at Equifax, Experian and TransUnion. It blocks most new accounts opened in your name, and you can lift it whenever you apply for credit yourself.
- 2
Don't pay extortion emails
If someone emails you threatening to leak your data, don't pay or reply. Report it to the FBI's Internet Crime Complaint Center at ic3.gov.
- 3
Watch statements and credit reports
Check your bank, card and insurance statements for anything you don't recognize, and review your reports at annualcreditreport.com.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.
Frequently asked
Was I affected by the INTEGRIS Health breach?
Affected people received a letter from INTEGRIS. A later notice covered patients of its community hospitals.
What was exposed?
Notices list name, date of birth, contact information, demographic information and Social Security number.
Should I pay if I get a ransom email?
No. Report it and delete it. Paying doesn't guarantee the data stays private.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
