Newkirk Products newkirkproducts.com Newkirk Products data breach: what happened and what to do
Newkirk Products, which makes health plan ID cards, learned that unauthorized people had accessed a server holding data on 3,992,270 health plan members. It included names, addresses, plan and member IDs, and sometimes birth dates.
View all 13,177 breaches- Breach date
- 21 May 2016
- Data exposed
- Names, Physical addresses, Health insurance information, Dates of birth
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Newkirk Products, Inc. issues member healthcare ID cards for health plans and claims administrators. Soon after a new parent company acquired it, Newkirk learned that, before the acquisition, unauthorized individuals had accessed a computer server holding electronic protected health information on 3,992,270 health plan members. The U.S. Department of Health and Human Services (HHS) describes the case. HHS's public breach portal lists a different total, so this page uses the number from HHS's own description.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What was exposed
HHS says the data was some combination of the member's name, mailing address, type of plan, member and group ID number, names of dependents, primary care provider and, in some cases, a Medicaid ID number, date of birth and premium invoice information.
The company's response
Newkirk notified HHS, the media, its health plan clients and the people affected, and offered two years of identity protection and restoration services at no cost. It contacted law enforcement and ran a forensic investigation, and the former parent decommissioned the affected server. Newkirk built a new IT environment under its new parent's security controls and limited access to authorized client IP addresses. HHS says it obtained assurances that these corrective actions were carried out.
What it means for you
A member ID, plan details and a date of birth can be used to file false medical claims or to talk a call center into account changes. Expect phishing that mentions your health plan.
What to do if you were in it
- 1
Place a free credit freeze
A freeze at Equifax, Experian and TransUnion blocks new accounts opened in your name. It's free, and the FTC explains how credit freezes and fraud alerts work.
- 2
Watch your statements and explanations of benefits
Look for charges, accounts or medical bills you don't recognize, and check your credit reports at annualcreditreport.com.
- 3
Report identity theft right away
If someone misuses your details, report it at IdentityTheft.gov to get a recovery plan.
- 4
Expect phishing that mentions the breach
Don't click links in unexpected messages. The FTC explains how to recognize and avoid phishing.
- 5
Check which other breaches include you
Run a free Serus scan to see which other breaches include your email or phone. Serus monitors breach databases and the dark web and alerts you; it can't remove data from a breach.
Official filings
- U.S. Department of Health and Human Services , filed 9 Aug 2016 : 3,466,120 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Newkirk Products breach?
If your health plan's ID card was issued by Newkirk Products, you may have been. Affected people were sent notices.
What was exposed?
Names, addresses, plan type, member and group IDs, dependents' names and primary care provider, and in some cases Medicaid IDs, birth dates and premium invoice information, according to HHS.
Is identity protection available?
HHS says Newkirk offered affected people two years of identity protection and restoration services at no cost. That offer has likely ended.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
