Iron Mountain ironmountain.com Iron Mountain data breach: what happened and what to do
In 2014, Iron Mountain reported that X-rays of 49,714 patients were compromised after former employees allegedly stole boxes of films and sold them to a recycler. The HHS entry is dated August 15, 2014. It was a theft of physical records, not a hack.
View all 13,115 breaches- Breach date
- 15 Aug 2014
- Made public
- 15 Aug 2014
- Affected
- 49,714
- Data exposed
- Medical records
- Last updated
What happened
Iron Mountain, a records storage company, is a business associate of healthcare providers, which means it stores records on their behalf. According to HIPAA Journal, two former employees allegedly stole 742 boxes of X-rays belonging to Orthopaedic Specialty Institute Medical Group and sold them to a recycling firm for the silver in the film. HHS lists the incident with 49,714 people affected, dated August 15, 2014, under improper disposal, loss and theft of paper and film records.
HIPAA Journal reported that the same former employees were later tied to records of other medical practices, including 2,691 patients of Riverside Medical Clinic. Those are separate counts.
What was exposed
The records were X-ray films, which carry a patient's name and imaging details. HIPAA Journal's assessment was that the films were probably taken for their silver, not their data, so the risk to individuals was low.
What it means for you
This was a physical theft, so the usual breach consequences, such as stolen passwords or leaked Social Security numbers, don't apply here. If you were notified, the practical risk is a stranger seeing your imaging.
What to do if you were in it
- 1
Check your notice
If you got a letter from your medical provider, it names what was stored. Keep it with your medical records.
- 2
Review your insurance statements
Read your explanation of benefits and question any care you didn't receive.
- 3
Ask your provider about your records
You can ask what imaging of yours was stored with Iron Mountain and what the provider has done to protect it.
- 4
Check whether your details are in other breaches
Run a free Serus scan to see whether your email or phone number appears in this or other breaches. Serus monitors breach databases and the dark web and alerts you, but it can't remove data that has already leaked.
Frequently asked
Was I affected by the Iron Mountain breach?
Affected patients were notified by their medical provider. If you were a patient of Orthopaedic Specialty Institute Medical Group, ask the practice.
What was exposed?
X-ray films. This was a theft of physical records, not an online data leak.
Should I change my password?
No. No online accounts or passwords were involved.
How many people were affected?
HHS lists 49,714 people for this incident.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
