MCG Health mcg.com MCG Health data breach: what happened and what to do
MCG Health, a Seattle company that supplies care guidelines to hospitals and insurers, reported a data theft affecting 793,283 people to HHS in June 2022. Names, addresses, birth dates, Social Security numbers and medical codes were involved.
View all 13,115 breaches- Breach date
- 25 Feb 2020
- Made public
- 10 Jun 2022
- Affected
- 793,283
- Data exposed
- Names, Physical addresses, Phone numbers, Email addresses, Dates of birth, Social security numbers, Medical codes
- Last updated
What happened
MCG Health is a Seattle company that writes care guidelines used by hospitals and health insurers, so patients usually never deal with it directly. In June 2022 it told clients and regulators that an unauthorized party had obtained files from its systems. It reported the incident to the US Department of Health and Human Services (HHS) as affecting 793,283 people. A notice filed with the Maine Attorney General put the figure at up to 1.1 million, so the number depends on which filing you read.
The timeline is murky. MCG told Maine regulators the data may have been acquired around February 25 and 26, 2020, and reporting says MCG learned of the problem in March 2022 after a third party contacted it. MCG has said it could not conclusively determine whether personal information was actually accessed. Notification letters went out in June 2022.
What was exposed
Coverage of MCG's client notices lists names, addresses, phone numbers, email addresses, genders, dates of birth, medical codes and Social Security numbers. Not every client's notice listed every item.
The Social Security number plus date of birth combination is the serious part. It's what criminals need to open credit accounts in your name or file a false tax return. Medical codes describe diagnoses and procedures, which can feed convincing phishing from someone posing as your insurer or clinic.
MCG's response
MCG offered two years of complimentary credit monitoring and identity theft protection to people who were notified. Class action lawsuits followed, and MCG later agreed to an $8.8 million settlement, according to HIPAA Journal.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A freeze stops anyone from opening new credit in your name. It's free and takes a few minutes each at Equifax, Experian and TransUnion. Lift it when you apply for credit yourself.
- 2
Take the credit monitoring if you got a letter
The letter has a code and an enrollment deadline. It's free, and it alerts you to new accounts opened under your Social Security number.
- 3
Read your insurance statements
Check each explanation of benefits for services you didn't receive. A claim you don't recognize can mean someone is using your identity for medical care.
- 4
Expect phishing that mentions your health
Emails, texts and calls from someone claiming to be your insurer or a hospital, asking you to confirm your details, are scams. Hang up and call the number on your insurance card.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up. It can't remove data that already leaked, so the steps above matter most.
Frequently asked
Was I affected by the MCG Health data breach?
MCG supplies guidelines to many health plans and hospitals, so the notice came through them. If you got a letter from MCG or from a health provider or insurer naming MCG, you were affected. HHS lists 793,283 people.
What information was exposed?
Names, addresses, phone numbers, email addresses, genders, dates of birth, medical codes and Social Security numbers, depending on the individual notice.
Is there a settlement?
Yes. HIPAA Journal reports MCG agreed to an $8.8 million class action settlement. Check the settlement administrator's site for claim rules and deadlines.
Should I change my password?
Passwords weren't listed as exposed, so a password change isn't the priority. A credit freeze is.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
