NextGen Healthcare nextgen.com NextGen Healthcare data breach: what happened and what to do
NextGen Healthcare said someone used stolen client credentials to reach a database between March 29 and April 14, 2023. About 1.05 million people were affected, with names, dates of birth, addresses and Social Security numbers taken.
View all 13,115 breaches- Breach date
- 29 Mar 2023
- Made public
- 3 May 2023
- Affected
- 1,049,375
- Data exposed
- Names, Dates of birth, Physical addresses, Social security numbers
- Last updated
NextGen Healthcare makes electronic health record software used by medical practices. In 2023 it told regulators that an attacker had reached one of its databases. A filing with the Maine Attorney General listed 1,049,375 people affected in total.
What happened
Reports put the unauthorized access between March 29 and April 14, 2023. The filing describes the cause as use of client credentials that appear to have been stolen from other sources or incidents unrelated to NextGen. In other words, the attacker logged in with real usernames and passwords rather than breaking through a software flaw. Sources differ on the discovery date, with the Maine filing giving April 24, 2023 and other coverage saying suspicious activity was flagged on March 30. Letters went out on April 28, 2023.
What was exposed
The notices list names, dates of birth, addresses and Social Security numbers. NextGen said there was no evidence that any protected health information or medical records were accessed.
Even without medical records, that combination is what identity thieves use to open credit or file fraudulent tax returns in your name. Dates of birth don't change, so the risk doesn't expire.
The company's response
NextGen reset passwords after the discovery and offered 24 months of free fraud detection and identity theft protection. A class action was later filed against the company in federal court in Georgia. It alleges NextGen did not follow federal and industry guidelines for protecting data. That is an allegation, not a finding.
What to do if you were in it
- 1
Freeze your credit
Place a free credit freeze at Equifax, Experian and TransUnion so nobody can open new credit in your name. Then check your reports at annualcreditreport.com. The FTC explains how freezes work.
- 2
Take the free credit monitoring if it's offered
NextGen offered 24 months of fraud detection and identity theft protection. Use the details in your letter. It alerts you to new credit activity but doesn't stop it, so pair it with a freeze.
- 3
File your taxes early
A leaked Social Security number makes a fake tax return possible. Filing early makes that harder, and you can create an account at IdentityTheft.gov if someone files in your name.
- 4
Expect scams that mention the breach
Emails, texts and calls that quote real details about you, or offer help with the breach, are a common follow-up. Don't click links in them. Go to the company's own site or phone number instead.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your details and alerts you when they show up in a new leak.
Frequently asked
Was I affected by the NextGen Healthcare breach?
NextGen sent letters to affected people in April 2023. You may be affected if a medical practice you've visited used NextGen's software.
What was exposed?
Names, dates of birth, addresses and Social Security numbers. NextGen said it found no evidence that medical records were accessed.
How did the attacker get in?
With client credentials that appear to have been stolen elsewhere, according to the Maine Attorney General filing.
Is there a lawsuit?
A class action was filed in federal court in Georgia.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
