OakBend Medical Center oakbendmedcenter.org OakBend Medical Center data breach: what happened and what to do
OakBend Medical Center in Texas reported a ransomware attack that began September 1, 2022 and affected up to 500,000 people. Exposed data included names, dates of birth, addresses, Social Security numbers and treatment information.
View all 13,177 breaches- Breach date
- Sept 2022
- Affected
- 500,000
- Data exposed
- Names, Dates of birth, Physical addresses, Social security numbers, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
OakBend Medical Center and OakBend Medical Group in Richmond, Texas reported a ransomware attack to HHS that affected the health information of 500,000 people.
What happened
Press coverage says the hospital was hit by ransomware on September 1, 2022, took its systems offline and referred the attack to the FBI. A notice dated October 25 said certain servers and computers were encrypted and that a limited amount of data was transferred out of its environment. A later update confirmed patient data had been taken.
Sources checked: techtarget.com, bankinfosecurity.com, ocrportal.hhs.gov
Last verified against the official page:
What was exposed
HHS's case summary lists names, dates of birth, addresses, Social Security numbers and other treatment information. With that combination, criminals can open credit in your name or write convincing messages that claim to come from the hospital or your insurer.
The response
Per HHS, OakBend notified people, the media and HHS, posted substitute notice, added safeguards and offered complimentary credit monitoring. Press reports put the monitoring at 18 months.
What this means for you
If you've been treated at OakBend, check your mail for a notice and take the steps below. The credit freeze matters most.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
Social Security numbers and dates of birth are enough to open accounts in your name. A credit freeze is free, and you place it separately at Equifax, Experian and TransUnion. The FTC explains how: https://consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- 2
Read your insurance statements
Check explanation of benefits statements and medical bills for care you didn't receive. If something looks wrong, call your insurer and the provider.
- 3
Expect phishing that mentions the breach
Calls, texts and emails that quote real details about you are more convincing. Don't click links or give out information; contact the organization using a number from its own website. The FTC's breach guide is at https://www.identitytheft.gov/databreach
- 4
Check whether your details are in other breaches
Run a free Serus scan to see whether your email or phone number shows up in this and other breaches. Serus can't remove breach data, but it alerts you when your details appear in new ones.
Official filings
- U.S. Department of Health and Human Services , filed 28 Oct 2022 : 500,000 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the OakBend breach?
OakBend says it notified affected people and posted a public notice. If you were a patient and want to confirm, contact OakBend directly.
What was exposed?
Names, dates of birth, addresses, Social Security numbers and other treatment information, according to HHS's summary.
Does OakBend offer credit monitoring?
Yes. HHS's summary says complimentary credit monitoring was provided, and press reports say for 18 months.
Sources
- techtarget.com/healthtechsecurity/news/366593980/OakBend-Medical-Center-Provides-Healthcare-Data-Breach-Notice
- bankinfosecurity.com/texas-hospital-says-ransomware-breach-affected-500000-a-20454
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
