Solara Medical Supplies solaramedical.com Solara Medical Supplies data breach: what happened and what to do
Between April and June 2019, an attacker got into eight Solara Medical Supplies employee email accounts through phishing, exposing the health information of 114,007 people. HHS announced a $3,000,000 settlement in January 2025 after finding Solara had no compliant risk analysis.
View all 13,177 breaches- Breach date
- Apr 2019
- Affected
- 114,007
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Solara Medical Supplies, LLC supplies continuous glucose monitors, insulin pumps and other diabetes products directly to patients. According to the U.S. Department of Health and Human Services (HHS), an unauthorized third party gained access to eight Solara employee email accounts between April and June 2019 through a phishing attack. The breach involved the electronic protected health information of 114,007 individuals.
In January 2020 Solara reported a second problem: it had mailed 1,531 breach notification letters to the wrong addresses.
Sources checked: hhs.gov, mlo-online.com, consumer.ftc.gov
Last verified against the official page:
What HHS found
HHS's Office for Civil Rights concluded that Solara had not carried out a compliant risk analysis, had not put enough security measures in place and had not notified individuals, HHS and the media in time. On January 14, 2025, HHS announced a resolution agreement: Solara agreed to pay $3,000,000 and follow a corrective action plan monitored for two years. The agreement is not an admission of liability.
What this means for you
Email accounts at a medical supplier hold the kind of details that criminals reuse: names, contact details and information about diagnoses and supplies. Press coverage also mentions Social Security numbers and payment details. HHS does not list the data types, so check your own notice letter for what applied to you.
Solara's parent company also settled a class action over the phishing incident in 2022, according to press coverage.
What to do if you were in it
- 1
Read your notice letter for what applied to you
Solara's letter says which of your details were involved. What you do next depends on it, so use it rather than guessing.
- 2
Freeze your credit at all three bureaus
A credit freeze is free and stops anyone opening new credit in your name. Place one at Equifax, Experian and TransUnion; the FTC explains how. Do this if your letter lists a Social Security number.
- 3
Check insurance statements for care you didn't get
Look through explanation-of-benefits statements for claims you don't recognize. If you find one, call your insurer. The FTC lists medical identity theft steps.
- 4
Expect phishing that mentions the breach
Diabetes supply, insurance and Medicare scams often quote real details. Don't click links or call numbers in unexpected messages. Go to the company's own website instead, and report scams at ReportFraud.ftc.gov.
- 5
Report misuse and watch your reports
Check your credit reports at annualcreditreport.com. If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
Official filings
- U.S. Department of Health and Human Services , filed 17 Jan 2020 : 1,531 people
- U.S. Department of Health and Human Services , filed 13 Nov 2019 : 114,007 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Solara breach?
HHS reports 114,007 individuals in the phishing breach. If Solara mailed you a notice, you were one of them. Some people also received notices sent to wrong addresses.
Is there a settlement?
HHS announced a $3,000,000 resolution agreement with Solara on January 14, 2025. That goes to the government. Press coverage also reports a 2022 class action settlement involving Solara's parent company.
What was exposed?
Protected health information from eight employee email accounts. The exact items differ by person, so check your notice letter.
Should I freeze my credit?
If your notice mentions a Social Security number, yes. A freeze is free at Equifax, Experian and TransUnion.
Sources
- hhs.gov/about/news/2025/01/14/hhs-office-civil-rights-settles-hipaa-phishing-cybersecurity-investigation-solara-medical-supplies-3000000.html
- hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/solara-ra-cap/index.html
- mlo-online.com/home/news/55261430/2019-breaching-incident-results-in-3000000-settlement
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov
- consumer.ftc.gov/articles/medical-identity-theft
Something wrong or out of date? Tell us and we'll re-check it.
