Regal Medical Group regalmed.com Regal Medical Group data breach: what happened and what to do
A ransomware attack on Regal Medical Group, a California medical group, began on or about 1 December 2022. Regal told HHS it affected 3,300,638 patients. Exposed data may include names, dates of birth, Social Security numbers, addresses and treatment and insurance details.
View all 13,115 breaches- Breach date
- Dec 2022
- Made public
- 1 Feb 2023
- Affected
- 3,300,638
- Data exposed
- Names, Social security numbers, Dates of birth, Physical addresses, Phone numbers, Treatment information, Health insurance information
- Last updated
What happened
Regal Medical Group is a medical group in California that works with several affiliated groups, including Lakeside Medical Organization, Affiliated Doctors of Orange County and Greater Covina Medical Group. Its breach notice says a ransomware attack happened on or about 1 December 2022. Staff noticed problems with its servers on 2 December, and Regal learned on 8 December that patient data had been affected.
Regal began mailing notice letters on 1 February 2023. It reported the incident to the US Department of Health and Human Services (HHS) as affecting 3,300,638 patients. The count covers the affiliated groups and all states. The California and Washington attorney general breach lists carry much smaller numbers because each shows only the residents of that one state.
According to Regal's notice, the information involved may have included:
- Names, dates of birth, addresses and phone numbers
- Social Security numbers, for some people
- Diagnosis and treatment details, lab results, prescriptions and radiology reports
- Health plan member numbers
Health records carry more risk than a leaked email address because you can't change them. A date of birth plus a Social Security number is enough to open credit in your name. A health plan number can be used for medical identity theft, where someone gets care or files claims under your identity. Treatment details can also make a scam call or letter far more believable.
Regal offered affected patients one year of free credit monitoring and set up a dedicated phone line listed in the letter. Class action lawsuits followed the notice.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
Contact Equifax, Experian and TransUnion and place a free credit freeze. It stops new accounts being opened with your Social Security number.
- 2
Read your explanation of benefits
Check statements from your health plan for services or claims you don't recognize. Report anything odd to the plan right away.
- 3
Take the credit monitoring offer
If you got a letter, enroll in the free monitoring it offers. Use the code from your own letter, not one from an email or text.
- 4
Be careful with calls and letters about your care
Scammers who know your diagnosis or prescriptions can sound like your doctor or insurer. Hang up and call the number on your insurance card.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data appears, so you hear about the next one too.
Frequently asked
Was I affected by the Regal Medical Group breach?
If you got a notice letter from Regal or one of its affiliated groups, yes. Regal mailed letters to everyone affected starting 1 February 2023. The notice page lists a number to call.
What was exposed?
Names, dates of birth, addresses, phone numbers, health plan member numbers and treatment details such as diagnoses, lab results and prescriptions. Social Security numbers were involved for some people.
How many people were affected?
Regal reported 3,300,638 patients to HHS.
Is there a settlement?
Class action lawsuits were filed after the breach. No settlement has been announced in the sources cited here.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
