Refuah Health Center data breach: what happened and what to do

Refuah Health Center, a New York health center, reported a malware attack affecting 260,740 people. Its notice, dated April 29, 2022, says the network was accessed on May 31 and June 1, 2021. Social Security numbers, driver's license numbers, financial and health information were involved.

View all 13,177 breaches

Breach date: 31 May 2021
Affected: 260,740
Data exposed: Names, Dates of birth, Driver's licenses, Social security numbers, Government issued IDs, Financial information, Lab results, Medications, Diagnoses, Health insurance information
Last updated: 29 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

Refuah Health Center, a federally qualified health center in New York, reported to the U.S. Department of Health and Human Services that a malware attack compromised the health information of 260,740 people. Its notice, dated April 29, 2022, says unauthorized access to its network happened on May 31 and June 1, 2021, and that its investigation finished on March 2, 2022. Reporters noted the long gap between the attack and the notification.

The New York Attorney General later reached a settlement with Refuah that included a $1.2 million commitment to security improvements, reporting says.

Sources checked: ocrportal.hhs.gov, hipaajournal.com, healthitsecurity.com

Last verified against the official page: 29 Oct 2026

How we research this Report an error

What was exposed

HHS lists names, dates of birth, driver's license and Social Security numbers, financial information, lab results, medications, state identification numbers, diagnoses, and health insurance and other treatment information.

An ID number plus a Social Security number and date of birth is a strong starting point for identity theft. Lab results and diagnoses can be used to craft messages that look like they come from your health center.

The health center's response

Refuah notified HHS, the affected people and the media, and provided substitute notice. It said it implemented additional administrative, technical and security safeguards.

What to do if you were in it

1

Read the notice letter

If you were affected you should get a letter from the organization. It says which of your details were involved and whether it offers free credit monitoring. The FTC recommends taking that offer.
2

Freeze your credit

Because Social Security numbers were involved, place a free credit freeze at Equifax, Experian and TransUnion. The FTC explains how. Check your reports at annualcreditreport.com.
3

Read your health insurance statements

Look at explanation of benefits statements for treatment or claims you don't recognize, and tell your insurer if something is wrong.
4

Treat messages about the breach as suspect

Expect calls, texts and emails that use real details. Don't click links or give details to someone who contacts you first; contact the organization using a number from its own website.
5

Report misuse

If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
6

Check whether your email or phone is in this and other breaches

Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus alerts you when they show up in a new leak.

Official filings

U.S. Department of Health and Human Services , filed 29 Apr 2022 : 260,740 people

Timeline

31 May 2021
The breach happened
29 Apr 2022
Reported to U.S. Department of Health and Human Services

Frequently asked

Was I affected by the Refuah Health Center data breach?

The organization sent letters to the people whose details were involved. If you were a patient and got no letter, contact it directly using the contact details on its own website.

What was exposed?

Names, dates of birth, driver's license, state ID and Social Security numbers, financial information, lab results, medications, diagnoses, and health insurance and other treatment information, according to HHS.

Should I freeze my credit?

If your Social Security number was exposed, a freeze is a sensible step. It's free, you set it up at each of the three bureaus, and you can lift it when you need to apply for credit.