NorthShore University HealthSystem northshore.org NorthShore University HealthSystem data breach: what to do
A business associate of NorthShore University HealthSystem was hit by ransomware, and HHS lists 348,746 people as affected (September 2020). The data included names, addresses, birth dates, Social Security numbers, financial information and treatment information.
View all 13,177 breaches- Breach date
- 4 Sept 2020
- Affected
- 348,746
- Data exposed
- Names, Physical addresses, Dates of birth, Social security numbers, Financial information, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
NorthShore University HealthSystem, a hospital group in the Chicago area, reported to the US Department of Health and Human Services (HHS) that a business associate had suffered a ransomware attack. A business associate is an outside company that handles patient data on a health provider's behalf. HHS lists 348,746 people as affected.
What was exposed
HHS's description says the records contained names, addresses, dates of birth, Social Security numbers, financial information and treatment information. NorthShore notified HHS, the individuals and the media, and provided substitute notice.
The HHS text mentions "approximately 345,161" people while the portal's total reads 348,746. This page uses the portal figure and treats the two as the same breach. Either way, it's hundreds of thousands of patients.
Why this combination matters
Social Security numbers plus birth dates are what lenders and tax agencies use to confirm who you are, so criminals value them. Financial information adds the risk of attempts to reach your accounts. Treatment information can feed targeted scams that mention a real provider or condition.
The attack happened at the vendor, and HHS's entry doesn't name it or give the date. If you were a NorthShore patient around 2020, look for a notice letter. If one never arrived, ask the health system directly whether your record was included.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What to do if you were in it
- 1
Freeze your credit
A credit freeze is free and stops lenders from opening new accounts in your name. Place it separately at Equifax, Experian and TransUnion, as the FTC explains. Lift it only when you apply for credit yourself.
- 2
Read your health insurance statements
Check explanation of benefits statements and medical bills for care you didn't get. If you see something wrong, call your insurer and the provider's billing office, and report it to the FTC at IdentityTheft.gov.
- 3
Watch your bank and card statements
Financial information was in the data, so check statements often and tell your bank at once about anything you don't recognize.
- 4
Expect messages that mention the breach
Criminals use your name, address and provider to make scam emails, texts and calls sound real. Don't click links or call numbers in them. Go to the company's own site, or call the number on your card or statement.
- 5
Report misuse
If someone opens accounts or files claims in your name, report it at IdentityTheft.gov, the FTC's reporting site, which gives you a recovery plan.
Official filings
- U.S. Department of Health and Human Services , filed 4 Sept 2020 : 348,746 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the NorthShore breach?
HHS lists 348,746 people. If you were a NorthShore patient and got no letter, contact the health system to ask.
What was exposed?
Names, addresses, dates of birth, Social Security numbers, financial information and treatment information, per HHS.
Who was breached?
HHS says a business associate of NorthShore suffered the ransomware attack. The vendor isn't named in the entry.
Should I freeze my credit?
Yes, with a Social Security number in the data, a free freeze at all three bureaus is the FTC's advice.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
