OneTouchPoint onetouchpoint.com OneTouchPoint data breach: what happened and what to do
OneTouchPoint, a printing and mailing vendor for health plans, was hit by ransomware in April 2022. HHS lists 4,112,892 people affected. Exposed data included names, addresses, dates of birth, conditions, medications and treatment information.
View all 13,115 breaches- Breach date
- 27 Apr 2022
- Made public
- 27 Jul 2022
- Affected
- 4,112,892
- Data exposed
- Names, Physical addresses, Dates of birth, Medications, Treatment information
- Last updated
What happened
OneTouchPoint prints and mails materials for health plans and healthcare providers. Reports say a ransomware group got into its network on April 27, 2022, and the company found encrypted files on April 28. It told its customers in early June and published a public notice in late July.
Because it works for others, the breach hit people who never dealt with OneTouchPoint: reporters counted dozens of health plans and providers among its customers. HHS lists 4,112,892 people affected. Earlier reports gave smaller counts, so the total grew as the investigation went on.
What was exposed
HHS's description says the data included names, addresses, dates of birth, diagnoses and conditions, medications and other treatment information. Early coverage also mentioned member IDs. The company said it found no evidence of misuse.
This kind of data fuels targeted phishing. A message that knows your health plan and a condition looks real. Your date of birth and address also help someone pass as you.
The company's response
OneTouchPoint notified HHS, affected individuals and the media, and added administrative, technical and security safeguards. HHS says its Office for Civil Rights gave the company technical assistance.
What to do if you were in it
- 1
Look for a letter from your health plan
Many people were notified by their insurer or provider, not by OneTouchPoint. If you got one, read which items applied to you.
- 2
Read your insurance statements
Check explanation of benefits statements for care you didn't receive and report anything odd.
- 3
Expect phishing that mentions your health plan
Don't click links or give details to anyone who contacts you first. Call the number on your insurance card.
- 4
Consider a credit freeze
The reported data doesn't include Social Security numbers, but dates of birth and addresses are enough for some fraud. A freeze at Equifax, Experian and TransUnion is free.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they show up in a new leak.
Frequently asked
How many people were affected by the OneTouchPoint breach?
HHS lists 4,112,892 people. Early reports gave lower numbers.
Why did I get a letter about a company I never heard of?
OneTouchPoint handled mailings for health plans and providers, and those customers notified their members.
Were Social Security numbers exposed?
HHS's description doesn't list them. It lists names, addresses, dates of birth, conditions, medications and treatment information.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
