Shields Health Care Group shields.com Shields Health Care Group data breach: what happened and what to do
An attacker was inside Shields Health Care Group's systems from March 7 to March 21, 2022. About 2 million patients were affected, per the figure Shields reported to HHS. Names, Social Security numbers, birth dates and medical details were involved.
View all 13,115 breaches- Breach date
- 7 Mar 2022
- Made public
- 27 May 2022
- Affected
- 2,000,000
- Data exposed
- Names, Social security numbers, Dates of birth, Physical addresses, Medical information, Health insurance information
- Last updated
What happened
Shields Health Care Group, a Massachusetts provider of medical imaging and surgical services, says someone gained access to its systems between March 7 and March 21, 2022. It began investigating on March 28 after a security alert. The company reported the incident to HHS on May 27, 2022.
The notice on its website did not give a number of people. Shields told HHS that about 2 million patients were affected, according to AP and SecurityWeek.
What was exposed
Reports list full names, Social Security numbers, dates of birth, home addresses, provider information, diagnoses, billing information, insurance numbers, medical record numbers and patient IDs. Not every person had every item.
The Social Security number plus a date of birth is the dangerous pairing: it's enough to apply for credit or file a tax return in someone's name. The medical details make convincing phishing, since a caller can name your provider or a procedure.
The company's response
Shields said it had no evidence the data was used for identity theft or fraud. It said it would send notices to affected people once its review was done, so letters went out in stages.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A freeze is free and stops most new accounts opened in your name. Place it separately at Equifax, Experian and TransUnion, and check your reports at annualcreditreport.com for accounts you don't recognize.
- 2
Read your insurance statements
Check explanation of benefits statements for treatment or claims you don't recognize, and report them to your insurer.
- 3
Expect phishing that mentions your care
Don't click links or give details to anyone who contacts you about imaging, billing or this breach. Call the number on your bill.
- 4
Consider filing taxes early
With a Social Security number exposed, filing early makes a fake return harder. You can also get an IRS Identity Protection PIN.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they show up in a new leak.
Frequently asked
How many people were affected by the Shields breach?
About 2 million, according to the figure Shields gave HHS as reported by AP and SecurityWeek. The company's own notice did not state a number.
Was my Social Security number exposed?
Reports list Social Security numbers among the data, but not every person's record had every item. Your letter from Shields lists what applied to you.
Should I freeze my credit?
If your letter lists a Social Security number or date of birth, yes. A freeze is free and easy to lift.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
