Sequoia Benefits and Insurance Services sequoia.com Sequoia Benefits and Insurance Services data breach: what happened and what to do
A cyberattack at Sequoia Benefits and Insurance Services (Sequoia Consulting Group) exposed the health information of 4,265 people, per HHS. Names, dates of birth, addresses, claims data, diagnoses, lab results and medications were involved. The intrusion began on September 22, 2022.
View all 13,177 breaches- Breach date
- 22 Sept 2022
- Made public
- 12 Dec 2022
- Affected
- 4,265
- Data exposed
- Names, Physical addresses, Dates of birth, Financial and claims information, Diagnoses, Lab results, Medications
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sequoia Benefits and Insurance Services does business as Sequoia Consulting Group, a benefits and HR firm that handles employee data for client companies. It told HHS that a cyberattack compromised the protected health information of 4,265 people.
What happened
Notices filed with state attorneys general give the intrusion window as September 22 to October 6, 2022. The company says it noticed a possible incident in October, hired forensic experts, and notified clients once it confirmed data was affected. Letters to individuals went out in December 2022.
Sources checked: ocrportal.hhs.gov, atg.wa.gov, techcrunch.com
Last verified against the official page:
What was exposed
HHS's description lists names, dates of birth, addresses, financial and claims information, diagnoses, lab results and medications. Reports on the case add that the affected storage held details such as gender, marital status and employment status. Social Security numbers are not listed in HHS's entry for this case, so check your own letter for what applies to you.
Health and claims data has a long shelf life. A diagnosis or medication list can't be changed the way a password can, and it gives scammers material for convincing calls about insurance or prescriptions.
The company's response
Sequoia notified HHS, the people affected and the media, and posted substitute notice. After discovering the breach it added administrative and technical safeguards to protect health information.
What to watch for
Expect messages that mention your benefits, your plan or your health. Verify any such contact through the number on your insurance card.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A freeze stops new credit being opened in your name and costs nothing. Place it with Equifax, Experian and TransUnion; the FTC explains how at consumer.ftc.gov. Lift it temporarily when you apply for credit yourself.
- 2
Read the notice letter and use the protection it offers
If a letter arrived, it lists what was exposed and often includes free credit monitoring or identity restoration with an enrollment deadline. Sign up before that date passes.
- 3
Watch your statements and credit reports
Check bank and card statements for charges you don't recognize, and pull your free credit reports at AnnualCreditReport.com. If something is wrong, report it at IdentityTheft.gov and follow the recovery plan it gives you.
- 4
Read your explanation of benefits
Check statements from your health insurer for services you didn't receive, and ask for a copy of your records if something looks wrong. Report medical identity theft at IdentityTheft.gov.
- 5
Expect phishing that mentions the breach
Scammers use news of a breach to sound legitimate. Don't click links or call numbers in unexpected texts or emails about it. Contact the company through the phone number or site on your own card or statement.
- 6
Check whether your email or phone is in this and other breaches
Serus monitors breach databases and the dark web and alerts you when your details appear, with steps for each case. A free scan shows where you stand today.
Official filings
- U.S. Department of Health and Human Services , filed 12 Dec 2022 : 4,265 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by this breach?
Check the notice letter you received. Organizations usually mail one to each person whose data was involved. If you have no letter and think your data was held, contact Sequoia Benefits and Insurance Services using the details on its own website.
Should I freeze my credit?
If your Social Security number or similar ID details were exposed, the FTC says a credit freeze is a free way to block new accounts being opened in your name. Place it with Equifax, Experian and TransUnion.
What should I do if I get a message about the breach?
Treat it with care. Criminals send fake breach alerts. Go to the company's own site or the number on your statements instead of using a link or number in the message.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- atg.wa.gov/data-breach-notifications
- techcrunch.com/2022/12/12/sequoia-human-resources-hackers/
- maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/b0f0f020-c1d8-408a-97be-7ab76094a7ae.shtml
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
