Planned Parenthood Los Angeles ppla.org Planned Parenthood Los Angeles data breach: what happened and what to do
Planned Parenthood Los Angeles reported a ransomware attack in October 2021 that compromised the health information of 409,759 people. Per HHS, the data included names, addresses, dates of birth, Social Security numbers, diagnoses, lab results, medications and insurance details.
View all 13,177 breaches- Breach date
- 9 Oct 2021
- Made public
- 1 Dec 2021
- Affected
- 409,759
- Data exposed
- Names, Physical addresses, Dates of birth, Social security numbers, Health insurance information, Medical information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Planned Parenthood Los Angeles (PPLA) reported that a ransomware gang got into its network between October 9 and October 17, 2021. PPLA detected the attack on October 17, and on November 4 it confirmed that some of the stolen files contained patient information. News coverage in early December 2021 reported the attack.
PPLA told HHS the health information of 409,759 people was involved. Press reports at the time rounded this to about 400,000.
Sources checked: hipaajournal.com, nbcnews.com, ocrportal.hhs.gov
Last verified against the official page:
What was exposed
HHS's summary of the case lists names, addresses, dates of birth, Social Security numbers, diagnoses and conditions, lab results, prescribed medications and health insurance information. What was taken varied from patient to patient.
What it means for you
Medical details combined with a Social Security number and date of birth are a strong basis for identity theft: opening credit, filing taxes or making insurance claims in your name. The health details are also personal, which makes phishing that quotes them more upsetting and more convincing. PPLA said it had no evidence the stolen information had been used for fraud.
The company's response
PPLA notified patients, HHS and the media, and said it strengthened its administrative and technical safeguards. A class-action lawsuit followed. A settlement report puts it at $6 million, but that comes from a single secondary source, so check the court record if the figure matters to you.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A Social Security number is in the exposed data, so a freeze is the strongest step. Per the FTC, a freeze is free, lasts until you lift it, and you place it separately at Equifax, Experian and TransUnion. You can also place a free fraud alert, which tells lenders to verify your identity first.
- 2
Read your insurer's explanation of benefits
Look for treatments, providers or claims you don't recognize. If you see one, tell your insurer and ask what it requires to flag the account. The FTC lists medical identity theft among the reasons to report to IdentityTheft.gov.
- 3
Expect messages that mention the breach
Mail, calls and texts that quote real details, such as your provider's name, are a common follow-up to a breach. Don't click links or give out information on an unsolicited call. Contact the organization using a number from its official site.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details appear. It can't remove data that has already leaked, so the steps above still matter.
Official filings
- U.S. Department of Health and Human Services , filed 30 Nov 2021 : 409,759 people
- Washington Attorney General , filed 31 Aug 2020 : 1,027 people
Timeline
-
Reported to the Washington Attorney General
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
-
The company made it public
Frequently asked
Was I affected by the Planned Parenthood Los Angeles breach?
If you got a notice from PPLA, yes. If you were a patient and didn't, contact PPLA to ask whether your records were in the files.
What was exposed?
HHS lists names, addresses, dates of birth, Social Security numbers, diagnoses, lab results, medications and health insurance information. It varied by patient.
Should I freeze my credit?
If your Social Security number was in your notice, yes. The FTC says a freeze is free and blocks most new accounts opened in your name.
Sources
- hipaajournal.com/400000-patients-potentially-affected-by-planned-parenthood-ransomware-attack/
- nbcnews.com/news/hackers-held-planned-parenthood-ransom-accessed-data-400000-users-rcna7336
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
