Medusind medusind.com Medusind data breach: what happened and what to do
Medusind, a medical billing company, found a breach at the end of December 2023. HHS lists 701,475 people affected. Exposed data varied by person and included Social Security numbers, health insurance and billing details, and payment card or bank account numbers.
View all 13,115 breaches- Breach date
- 29 Dec 2023
- Affected
- 701,475
- Data exposed
- Names, Health insurance information, Medical information, Social security numbers, Driver's licenses, Bank account numbers, Credit cards
- Last updated
What happened
Medusind, Inc. is a billing and revenue management company that works for healthcare providers. In December 2023 it detected unauthorized access to its systems. Reports give the date as around December 29, 2023, and Medusind sent notices to affected people more than a year later.
The count grew over time. A first report to the Maine Attorney General listed 360,934 people. The U.S. Department of Health and Human Services (HHS) breach portal later showed 701,475 people affected in total, and that is the number to use.
Because Medusind handles billing for other providers, many people never dealt with it directly. You may know it only as the company named in a letter about a doctor's visit.
What was exposed
Reports on the notices say the data differed from person to person. It included names and contact details, health insurance and billing information, medical history and prescription information, payment card or bank account numbers, and government identifiers such as Social Security numbers, driver's license numbers and passport numbers.
That mix is worse than a leaked email address. Health and insurance details let someone commit medical identity fraud, and a Social Security number lets them open credit. Billing details also make a convincing bait for a fake invoice or insurance call.
The company's response and the settlement
Medusind offered two years of free credit monitoring and identity theft protection. A class action followed, and HIPAA Journal reports that Medusind agreed to a $5 million settlement while denying wrongdoing. If you got a notice, check the settlement terms and deadlines before you assume you are covered.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A freeze stops new credit being opened in your name. It is free at Equifax, Experian and TransUnion. The FTC explains how it works and how to lift it when you need credit.
- 2
Use the free credit monitoring if it is offered
Medusind offered two years of free credit monitoring and identity protection. Enroll using the code in your notice letter before the deadline.
- 3
Read your statements and explanation of benefits
Look for accounts, charges or medical bills you don't recognize, and report them to the company right away.
- 4
Expect phishing that quotes real details
Scammers use leaked names and addresses to sound legitimate. Don't give out your Social Security number or card details to anyone who contacts you first.
- 5
Check whether your email or phone is in this and other breaches
Serus monitors breach databases and the dark web and alerts you when your email, passwords or other personal data appear, and tells you what to do next. It can't remove data that has already leaked, so the alert is the point: it tells you which passwords to change. You can run a free scan.
Frequently asked
Was I affected by the Medusind data breach?
HHS lists 701,475 people. If you got a notice letter, you were among them. If you were a patient of a provider that used Medusind for billing and got no letter, ask the provider.
What was exposed?
It varied by person. Reports list contact details, health insurance and billing information, medical and prescription details, payment card or bank account numbers, and Social Security numbers and other government IDs.
Is there a settlement?
HIPAA Journal reports Medusind agreed to pay $5 million to settle a class action over the breach and denies wrongdoing. Check the official settlement site for deadlines.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
