Monarch monarchnc.org Monarch data breach: what happened and what to do
Monarch, a North Carolina behavioral health provider, reported a ransomware incident affecting 56,155 people. Exposed data included names, birth dates, addresses, Social Security numbers, driver's license numbers, medications and insurance details.
View all 13,115 breaches- Breach date
- 29 Aug 2022
- Made public
- 16 Dec 2022
- Affected
- 56,155
- Data exposed
- Names, Dates of birth, Physical addresses, Social security numbers, Driver's licenses, Medications, Health insurance information, Treatment information
- Last updated
What happened
Monarch, a behavioral health provider in North Carolina, reported a ransomware incident to HHS in December 2022. HHS lists 56,155 people affected. In a filing with Massachusetts on December 16, 2022, Monarch said it first learned of the problem on August 29, 2022, according to DataBreaches.net.
What was exposed
HHS's description says the data included names, dates of birth, addresses, Social Security numbers, driver's license numbers, medications, health insurance information, claims and financial information, and other treatment information.
This is a heavy mix. Identity details let a criminal try to open accounts in your name, and the health details can be used to make a scam call sound real. Mental health information is also sensitive in its own right, so be careful about who you discuss it with if someone contacts you first.
Why the timeline matters
Monarch first learned of the problem on August 29, 2022, but HHS received the report months later. Letters can arrive well after an incident, so don't wait for a notice to start protecting yourself.
The company's response
Monarch notified HHS, affected individuals and the media, and posted a notice on its website. It offered free credit monitoring and added administrative, technical and security safeguards.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A freeze is free and stops most new accounts opened in your name. Place it separately at Equifax, Experian and TransUnion, and check your reports at annualcreditreport.com for accounts you don't recognize. If you got a credit monitoring code, use it too.
- 2
Replace your driver's license if you're worried
If your driver's license number was exposed, your state's motor vehicle agency can tell you whether to request a replacement or add a fraud flag.
- 3
Read your insurance statements
Check explanation of benefits statements for claims you don't recognize.
- 4
Expect calls and texts that mention your care
Don't share details with anyone who contacts you first. Call Monarch or your insurer on a number you look up yourself.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they show up in a new leak.
Frequently asked
How many people were affected by the Monarch breach?
HHS lists 56,155 people.
Were Social Security numbers exposed?
HHS's description says yes, along with driver's license numbers and health insurance information.
Is there free credit monitoring?
HHS says Monarch offered free credit monitoring to affected people. Your notice letter has the details.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
