KPMG LLP kpmg.com KPMG data breach: what happened and what to do
In 2010 a KPMG employee lost an unencrypted USB drive holding patient names and clinical information for New Jersey hospital patients. The U.S. health department lists 3,630 people affected. It's an old, small incident, and nothing in the public record says the drive was ever misused.
View all 13,177 breaches- Breach date
- 10 May 2010
- Made public
- 26 Aug 2010
- Affected
- 3,630
- Data exposed
- Names, Medical information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
In May 2010, an employee of KPMG LLP, the accounting and advisory firm, lost an unencrypted USB drive. KPMG was working as a business associate (a contractor that handles patient data for a healthcare provider) for hospitals in New Jersey. The drive held electronic health information from the hospitals, including Newark Beth Israel Medical Center, which reported 956 of its patients on the drive to the U.S. Department of Health and Human Services (HHS). HHS's public breach list shows 3,630 people affected in total.
Reports from the time say KPMG told one of the hospital systems about the loss in June 2010, and the breach was reported to HHS in September 2010. When the loss was discovered, KPMG searched the area where it had gone missing.
Sources checked: ocrportal.hhs.gov, hipaajournal.com, healthleadersmedia.com
Last verified against the official page:
What was exposed
HHS says the drive held names and clinical information. A hospital statement at the time said it didn't contain addresses, dates of birth or Social Security numbers. That limits what a criminal could do with it: names plus health details are enough for a convincing phishing call or letter that mentions a real treatment, but not enough on their own to open credit in someone's name.
What KPMG did
After HHS's Office for Civil Rights opened an investigation, KPMG installed encryption software on its equipment and devices, encrypted and password-protected all devices that could hold the hospitals' data, reprimanded and retrained the employee, and retrained all employees on protecting health information.
Was it misused?
No public report says the data was found or used by anyone. A lost drive isn't the same as a stolen database, and this one is more than 15 years old.
What to do if you were in it
- 1
Read your letter or notice
If a hospital or KPMG wrote to you, the letter says what was on the drive. Keep it with your records.
- 2
Check your health insurance statements
Look at the explanation of benefits your insurer sends and question any treatment or provider you don't recognize.
- 3
Be wary of messages that mention your care
Don't click links or give details to a caller or sender who quotes your hospital visit. Contact the hospital using a number from its own website.
- 4
Report misuse of your identity
If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
- 5
Check whether your email or phone is in other breaches
Run a free Serus scan to see whether your email or phone number appears in other breaches.
Official filings
- U.S. Department of Health and Human Services , filed 26 Aug 2010 : 3,630 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the KPMG data breach?
Only if you were a patient of one of the New Jersey hospitals whose data was on the drive, and you would have been notified by letter in 2010. HHS lists 3,630 people.
What was exposed in the KPMG breach?
HHS says names and clinical information. A hospital statement at the time said addresses, dates of birth and Social Security numbers weren't on the drive.
Should I change my password?
No passwords were reported as exposed, so there's nothing to change because of this incident.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
