Serviceaide serviceaide.com Serviceaide data breach: what happened and what to do
Serviceaide, an IT support vendor for Catholic Health in Buffalo, New York, reported that a database was publicly reachable online from September 19 to November 5, 2024. 483,126 people were affected. Data included names, Social Security numbers and treatment details.
View all 13,115 breaches- Breach date
- 19 Sept 2024
- Affected
- 483,126
- Data exposed
- Names, Social security numbers, Physical addresses, Medical information, Treatment information, Health insurance information
- Last updated
Serviceaide, Inc. provides IT support management software to health organizations, including Catholic Health in Buffalo, New York. In May 2025 it reported to the U.S. Department of Health and Human Services that a database holding patient information had been publicly available on the internet.
What happened
Serviceaide says it discovered on November 15, 2024 that data in a database it managed for Catholic Health could be reached without a login. The investigation found the database was exposed from about September 19 to November 5, 2024. Notification letters are dated May 5, 2025, and the breach was filed with HHS on May 9, 2025. It lists 483,126 people.
What was exposed
HHS's entry says the protected health information included names, Social Security numbers, addresses, diagnoses and conditions, lab results, medications and other treatment information. Press coverage of the notice also lists dates of birth, medical record numbers and health insurance information, and says some people's email usernames and passwords were involved. What you got depends on your record.
Social Security numbers and dates of birth are what criminals use for identity theft. Treatment details are sensitive in themselves and let scammers write convincing messages posing as a clinic or insurer. Because the database was open to anyone, the company says it couldn't rule out that data was copied.
The company's response
Serviceaide offered complimentary credit monitoring, added security safeguards and retrained staff. If your email and password were in the exposed records, change that password wherever you reuse it.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
Freezing your credit at Equifax, Experian and TransUnion stops anyone opening new accounts in your name. It's free and you can lift it when you need credit.
- 2
Read your letter and enroll in the credit monitoring
Serviceaide is offering complimentary credit monitoring. Sign up with the code in your notice before the deadline.
- 3
Check your health insurance statements
Review explanations of benefits for services you didn't receive. Report anything odd to your insurer.
- 4
Change reused passwords and turn on 2FA
If you used an email and password with Catholic Health systems, change that password everywhere you reuse it and turn on two-factor login.
- 5
Expect phishing that mentions the breach
Treat unexpected calls, texts and emails that mention this incident as suspect. Don't click links or give details. Contact the company using a number from its own website.
- 6
Check whether your email or phone is in this and other breaches
A free Serus scan checks breach databases for your email and phone number and tells you what to do about what it finds. Serus can't remove data from a breach, but it alerts you when your details turn up.
Frequently asked
Was I affected by the Serviceaide data breach?
Letters went out in May 2025, mostly to Catholic Health patients. If you were treated there and got no letter, contact Catholic Health.
How many people were affected?
483,126 people, according to HHS.
What was exposed?
Names, Social Security numbers, addresses, diagnoses, lab results, medications and other treatment information, plus more for some people.
Should I change my password?
Coverage of the notice says some email usernames and passwords were involved. If so, change that password everywhere you reuse it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
