Norton Healthcare nortonhealthcare.com Norton Healthcare data breach: what happened and what to do
Norton Healthcare, a Kentucky health system, found a ransomware attack on May 9, 2023. Letters went out from December 8, 2023 to about 2.5 million patients, employees and dependents. Names, Social Security numbers, dates of birth, health and insurance details were among the data. Norton says it paid no ransom.
View all 13,115 breaches- Breach date
- 7 May 2023
- Made public
- 8 Dec 2023
- Affected
- 2,500,000
- Data exposed
- Names, Contact information, Social security numbers, Dates of birth, Health information, Health insurance information, Medical identification numbers, Driver's licenses, Government issued IDs, Bank account numbers, Digital signatures
- Last updated
What happened
Norton Healthcare, a health system based in Louisville, Kentucky, discovered on May 9, 2023 that it was dealing with a cybersecurity incident, later identified as a ransomware attack. Its notice says an unauthorized person gained access to certain network storage devices between May 7 and May 9, 2023. Norton says its medical record system and MyChart were not accessed.
Norton finished its review in November and began mailing notices on December 8, 2023. Its filing with the Maine Attorney General counts about 2.5 million people, including patients, employees and their dependents.
What was exposed
The notice says the data varied by person and could include some or all of the following: name, contact information, Social Security number, date of birth, health information, insurance information and medical identification numbers. For some people it also included driver's license or other government ID numbers, financial account numbers and digital signatures.
Social Security numbers and dates of birth are the combination criminals use to open credit in someone else's name, and they stay useful for years. Health and insurance details can be used for medical identity fraud and for phishing that sounds like your insurer.
Norton's response
Norton says it reported the incident to law enforcement and did not pay a ransom. It offered 24 months of free credit monitoring and identity protection to people whose information was involved.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
Equifax, Experian and TransUnion each offer a free freeze. It blocks most new accounts opened with your Social Security number, and you can lift it when you apply for credit yourself.
- 2
Enroll in the free monitoring if you got a letter
Norton offered 24 months of credit monitoring and identity protection. Use the code in your letter before it expires.
- 3
Read your insurance statements
Look at explanation of benefits statements for care you didn't receive, and ask your insurer to flag your account if you see any.
- 4
Expect phishing that mentions your care or employer
Don't click links or return calls from unexpected messages about billing, insurance or the breach. Look up the real number and call it.
- 5
Watch your bank accounts
If your letter mentions financial account numbers, check statements for charges you don't recognize and ask your bank about new account numbers.
- 6
Check whether your email or phone number shows up in this and other breaches
Serus runs a free scan that checks your email and phone number against known breaches and the dark web, and alerts you when something new appears. It can't remove breach data, but it tells you what's out there so you know what to act on.
Frequently asked
Was I affected by the Norton Healthcare breach?
If you were a Norton patient or employee, or a dependent of one, you may have received a letter starting in December 2023. The letter lists which of your details were involved.
What data was exposed?
It varied by person: names, contact details, Social Security numbers, dates of birth, health and insurance information and medical ID numbers. Some people also had driver's license numbers, financial account numbers or digital signatures involved.
Did Norton pay the ransom?
Norton says it did not pay a ransom.
How long is the free credit monitoring?
Norton offered 24 months of credit monitoring and identity protection to affected people.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
