Morley Companies morleycompanies.com Morley Companies data breach: what happened and what to do
Morley Companies, a Michigan business services firm, reported a 2021 ransomware attack. HHS lists 659,194 people affected. Exposed data included names, addresses, dates of birth, Social Security numbers and health insurance and treatment details.
View all 13,177 breaches- Breach date
- 20 Jul 2021
- Made public
- 1 Feb 2022
- Affected
- 659,194
- Data exposed
- Names, Physical addresses, Dates of birth, Social security numbers, Health insurance information, Medications, Medical conditions, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Morley Companies, a business services provider based in Saginaw, Michigan, suffered a ransomware attack. The attack began on July 20, 2021, and company data became unavailable on August 1, 2021. Morley secured its network and started an investigation. It began notifying people in early February 2022, about six months later.
The U.S. Department of Health and Human Services (HHS) lists 659,194 individuals affected. Early press coverage cited a lower figure of 521,046, so counts differ by source. The people involved include Morley's employees, contractors and clients' customers.
Sources checked: ocrportal.hhs.gov, infosecurity-magazine.com, wilx.com
Last verified against the official page:
What was exposed
HHS says the information included names, addresses, dates of birth, health insurance information, medications, conditions, Social Security numbers and other treatment information.
That mix matters. A Social Security number with a date of birth is what criminals need to open credit in your name or file a fake tax return, sometimes months after the breach. Health insurance and treatment details can be used for medical identity theft, or to make a scam call sound convincing.
Morley's response
Morley paid for 24 months of identity theft protection through IDX for affected people and added technical and administrative safeguards. Michigan's Attorney General warned that the breach could lead to follow-on scams.
What to do
If you got a letter from Morley, use the monitoring offer in it. The steps below apply even if you never received one.
What to do if you were in it
- 1
Use the identity protection Morley offered
If your notice letter included a code for credit or identity monitoring, sign up with the instructions in the letter. The FTC recommends taking free monitoring a company offers after a breach.
- 2
Freeze your credit at all three bureaus
A credit freeze is free and blocks most new accounts opened in your name. You place it separately at Equifax, Experian and TransUnion, and the FTC explains how at consumer.ftc.gov. Lift it only when you apply for credit yourself.
- 3
Watch your statements and credit reports
Check bank, card and insurance statements for charges or claims you don't recognize. You can get free credit reports at AnnualCreditReport.com. If you find misuse, report it at IdentityTheft.gov.
- 4
Expect phishing that mentions the breach
Scammers use news of a breach to sound legitimate. Don't click links in unexpected emails or texts about it. Go to the company's own site, or call a number printed on your letter or card.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches your email or phone number appear in. Serus monitors breach databases and the dark web and alerts you when your data shows up, though it can't remove data from a breach.
Official filings
- U.S. Department of Health and Human Services , filed 1 Feb 2022 : 659,194 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Morley Companies breach?
Morley mailed notices to the people involved starting in February 2022. If you worked for Morley, or a company that used it for services, and you got no letter, contact Morley directly through its website to ask.
What was exposed in the Morley breach?
HHS lists names, addresses, dates of birth, health insurance information, medications, conditions, Social Security numbers and other treatment information.
How many people were affected?
HHS lists 659,194 individuals. Some early news reports gave 521,046, so the figure differs by source.
Should I freeze my credit?
Social Security numbers were involved, so yes. The FTC says a freeze is free and you place it at Equifax, Experian and TransUnion.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- infosecurity-magazine.com/news/data-breach-at-morley-companies/
- wilx.com/2022/02/11/ag-nessel-warning-data-breach-saginaw-company-could-open-door-secondary-scams/
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
