MultiPlan multiplan.com MultiPlan data breach: what happened and what to do
MultiPlan, a healthcare cost-management company, reported that an employee email account was compromised between December 2020 and January 2021. It affected 214,956 people and included Social Security numbers and health insurance details.
View all 13,177 breaches- Breach date
- 23 Dec 2020
- Affected
- 214,956
- Data exposed
- Names, Physical addresses, Email addresses, Dates of birth, Health insurance information, Claims information, Social security numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
MultiPlan works with health plans and providers on claims and pricing. Its notice says it found unauthorized access to one employee's email account by an outside party on January 27, 2021. Reporting on the filing gives the exposure window as December 23, 2020 to January 27, 2021. MultiPlan told the U.S. Department of Health and Human Services that an employee was the victim of an email phishing attack and that 214,956 people were affected. No evidence of misuse of the data was found, but the company could not rule out access.
Sources checked: ocrportal.hhs.gov, oag.ca.gov, hipaajournal.com
Last verified against the official page:
What was exposed
HHS lists names, addresses, email addresses, dates of birth, claims and health insurance information, and Social Security numbers. Claims and insurance details let scammers pose as your insurer, and the Social Security number and date of birth are what's needed to open credit in your name.
The company's response
MultiPlan notified HHS, the people affected and the media, and provided substitute notice. It offered two years of credit monitoring, sanctioned the employee, revised its policies, added technical safeguards and retrained staff on email security.
What this means for you
Most people affected never dealt with MultiPlan directly. It processed claims for their insurer. Your letter will say which entity's data was involved.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A freeze is free and stops lenders from seeing your credit report, which blocks most new accounts opened in your name. You place it separately at Equifax, Experian and TransUnion, per the FTC.
- 2
Enroll in the credit monitoring
MultiPlan offered two years of credit monitoring. The FTC recommends taking what a company offers. Use the instructions in your notice.
- 3
Treat insurance-related messages with suspicion
Expect emails and calls that mention claims or benefits. Don't click links in them. Log in through your insurer's site or call the number on your card.
- 4
Check your explanation of benefits
Look for claims you don't recognize and report them to your insurer.
- 5
Report misuse
Report identity theft at IdentityTheft.gov to get a recovery plan.
- 6
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up, so you know when to repeat these steps.
Official filings
- U.S. Department of Health and Human Services , filed 24 Jun 2021 : 214,956 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
How many people were affected by the MultiPlan breach?
HHS lists 214,956 people.
What was exposed in the MultiPlan breach?
Names, addresses, email addresses, dates of birth, claims and health insurance information, and Social Security numbers, per HHS.
Did MultiPlan offer credit monitoring?
Yes, two years, according to its notice.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- oag.ca.gov/system/files/Multiplan_Sample_Individual_Notice_FINAL.pdf
- hipaajournal.com/email-account-breaches-reported-by-multiplan-and-hawaii-independent-physicians-association/
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
Something wrong or out of date? Tell us and we'll re-check it.
