Postmeds postmeds.com Postmeds data breach: what happened and what to do
Postmeds, the online pharmacy behind Truepill, reported that its business associate was hit by a cyber incident that began August 30, 2023. HHS lists 2,369,026 people. Exposed data includes names, dates of birth and medications; some Social Security numbers.
View all 13,115 breaches- Breach date
- 30 Aug 2023
- Affected
- 2,369,026
- Data exposed
- Names, Dates of birth, Medications, Social security numbers
- Last updated
Postmeds, Inc. runs an online pharmacy that operates as Truepill and fills prescriptions for telehealth companies and their patients. In late 2023 it told federal regulators that a business associate (a vendor that handles patient data for it) had a cybersecurity incident.
What happened
An unauthorized party accessed patient files between August 30 and September 1, 2023. Postmeds began mailing letters on October 30, 2023. The report to the U.S. Department of Health and Human Services (HHS) counts 2,369,026 people, which makes it one of the larger health data breaches that year. The notice also appears on the California and Washington attorney general lists.
The HHS summary says the data included names, dates of birth, medications and, for some people, Social Security numbers. Earlier reporting on the company's statement said the files held patient names, medication types and, in some cases, demographic details or the prescriber's name. Check your letter: the types listed there apply to you.
Why medication data matters
A medication list says something about your health, and that makes it sensitive even without a Social Security number. It can be used to craft scams that sound credible, such as a call from a "pharmacy" about a refill, or to pressure someone who would rather keep a condition private. Health data can't be changed afterward, which is why this kind of exposure sticks around.
Where a Social Security number was included, the risk moves to identity theft: new credit, tax refund fraud and medical identity theft, where someone uses your insurance or name to get care.
The company's response
Postmeds said it notified HHS, the people affected and the media, and posted a substitute notice on its website. HHS's Office for Civil Rights gave the company technical assistance on the HIPAA rules. Several class action lawsuits followed, including one in the Northern District of California. Those are allegations, and nothing here is a finding by a court.
If you used a telehealth service that fills prescriptions through Truepill, that is the likely connection even if you never used the Postmeds name.
Steps specific to health data
Unlike a credit card, a prescription history can't be cancelled and reissued. The best response is to limit what a scammer can do with it. Don't confirm medications or conditions to anyone who contacts you first, even if they quote the correct drug name. Pharmacies and insurers don't need you to read back codes sent by text.
Where a Social Security number was listed, the credit freeze is the key step. Where it wasn't, the main risks are targeted scams and the privacy cost of someone knowing what you take. You can also ask your pharmacy and insurer for an accounting of disclosures, which US health privacy rules entitle you to request, and report any suspicious use of your insurance to the plan's fraud line.
What to do if you were in it
- 1
Read your notice letter for what was exposed
The data varies by person. Look for whether a Social Security number is listed, because that decides how much of the list below applies.
- 2
Freeze your credit
A freeze at Equifax, Experian and TransUnion stops new accounts being opened in your name. It's free, takes a few minutes per bureau and you can lift it when you need credit. Check your bank and card statements monthly.
- 3
Review your explanation of benefits and insurer statements
Medical identity theft shows up as claims or prescriptions you didn't make. Call your insurer if you spot one.
- 4
Expect pharmacy and refill scams
A call, text or email about a refill or prescription issue that mentions your medication is a common follow-up. Don't give details to inbound contacts. Call the pharmacy number on your bottle.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at Serus. Serus monitors breach databases and the dark web and alerts you when your data appears. It can't remove data from a breach, but it tells you what to do next.
Frequently asked
Was I affected by the Postmeds data breach?
Postmeds mailed letters starting October 30, 2023 to the people it identified. If you filled prescriptions through Truepill or a telehealth service that uses it around that time, check your mail.
What was exposed in the Postmeds breach?
HHS's summary lists names, dates of birth, medications and, for some people, Social Security numbers.
How many people were affected?
The HHS breach report lists 2,369,026 people.
Is there a settlement?
Class action lawsuits were filed after the breach. The sources reviewed don't report a settlement, so check the court docket or your letter for updates.
Should I change my password?
Passwords aren't in the listed data, so a reset isn't needed because of this breach. If you reuse passwords, change them anyway.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
