Meridian Health Services meridianhs.org Meridian Health Services data breach: what happened and what to do
Meridian Health Services Corp. reported to HHS that employees fell for an email phishing scheme, affecting 111,372 people. Names, addresses, dates of birth, Social Security numbers, driver's license and state ID details, and health information were involved.
View all 13,177 breaches- Breach date
- 27 Apr 2020
- Made public
- 27 Apr 2020
- Affected
- 111,372
- Data exposed
- Names, Physical addresses, Dates of birth, Driver's licenses, Social security numbers, Government issued IDs, Medical information, Health insurance information, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Meridian Health Services Corp., a behavioral health provider in Indiana, reported to the U.S. Department of Health and Human Services that several employees were the victims of an email phishing scheme. The incident affected the protected health information of 111,372 people. It was listed in April 2020.
According to HHS, the information involved included names, addresses, dates of birth, driver's license information, Social Security numbers, diagnoses and conditions, lab results, medications, state identification numbers, and health insurance and treatment information.
With that mix of data, the main risks are identity theft and medical identity theft. A Social Security number with a date of birth can be used to apply for credit. Health details can make a phishing call or text about a bill, a prescription or an insurance claim sound real.
The listing says the case was a hacking or IT incident, and HHS's description says the breach came from phishing of staff email.
Meridian notified HHS, affected people and the media, and provided substitute notice. It said it added administrative and technical safeguards and retrained staff to spot fraudulent emails.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A credit freeze is free and stops new accounts being opened with your Social Security number. You place it separately with Equifax, Experian and TransUnion, and you can lift it temporarily when you apply for credit. The FTC explains how at consumer.ftc.gov. A freeze doesn't stop charges on accounts you already have.
- 2
Review your health insurance statements
Check explanation-of-benefits statements for care or prescriptions you didn't get. Report anything odd to your insurer.
- 3
Report identity theft if you see it
If someone has used your information, file a report at IdentityTheft.gov to get a recovery plan.
- 4
Treat unexpected messages about bills or prescriptions with suspicion
Don't click links or give details to a caller or sender who contacts you first. Look up the number for your provider or insurer yourself.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email address or phone number.
Official filings
- U.S. Department of Health and Human Services , filed 27 Apr 2020 : 111,372 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Meridian Health Services breach?
If you were a patient, you may have been. Meridian says it notified affected people, so check for a letter. If you didn't get one, ask Meridian directly.
What was exposed?
HHS lists names, addresses, dates of birth, driver's license information, Social Security numbers, diagnoses, lab results, medications, state ID numbers and health insurance and treatment information.
How many people were affected?
111,372 people, according to the report to HHS.
Should I freeze my credit?
Because Social Security numbers were involved, a free credit freeze at Equifax, Experian and TransUnion is the FTC's recommended way to block new accounts in your name.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
