Sound Generations soundgenerations.org Sound Generations data breach: what happened and what to do
Sound Generations, a Seattle nonprofit serving older adults, reported ransomware attacks on July 18 and September 18, 2021. Its notice says 103,576 people's health information was on the affected systems, including names, contact details, dates of birth and insurance details.
View all 13,177 breaches- Breach date
- 18 Jul 2021
- Made public
- 15 Dec 2021
- Affected
- 103,576
- Data exposed
- Names, Physical addresses, Phone numbers, Email addresses, Dates of birth, Health insurance information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Sound Generations is a Seattle nonprofit that serves older adults and adults with disabilities. In a notice posted in December 2021, it said unauthorized people got into its systems and encrypted data on July 18, 2021, and again on September 18, 2021. That is a ransomware attack: the criminals lock the files and demand payment.
The investigation could not rule out that someone accessed the stored information. Sound Generations told the U.S. Department of Health and Human Services (HHS) that the health information of 103,576 people was on the affected systems. It was listed as a business associate, meaning it handles health data on behalf of other organizations.
Sources checked: hipaajournal.com, cdhs.colorado.gov, ocrportal.hhs.gov
Last verified against the official page:
What was exposed
The notice says the data may have included names, addresses, phone numbers, email addresses, dates of birth and insurance status. For people in its EnhanceFitness program, health insurance numbers may also have been exposed, and some health histories. Sound Generations says it doesn't collect or store Social Security numbers, driver's license numbers or financial account details.
What it means for you
With a name, address, phone number and date of birth, a scammer can make a phone call or letter sound like it comes from a real provider or insurer. Insurance numbers can be misused to file false claims. Older adults are common targets for these calls, so it's worth telling relatives who may have been affected.
The company's response
Sound Generations mailed letters dated December 15, 2021, and posted a substitute notice online for people whose addresses were wrong or missing. It said it had strengthened its security controls, including changing passwords and adding protections. It advised people to stay alert for fraud and to tell their financial institutions about any unauthorized activity.
What to do if you were in it
- 1
Expect messages that mention the breach
Mail, calls and texts that quote real details, such as your provider's name, are a common follow-up to a breach. Don't click links or give out information on an unsolicited call. Contact the organization using a number from its official site.
- 2
Read your insurer's explanation of benefits
Look for treatments, providers or claims you don't recognize. If you see one, tell your insurer and ask what it requires to flag the account. The FTC lists medical identity theft among the reasons to report to IdentityTheft.gov.
- 3
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details appear. It can't remove data that has already leaked, so the steps above still matter.
Official filings
- U.S. Department of Health and Human Services , filed 29 Nov 2021 : 456,243 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
-
The company made it public
Frequently asked
Was I affected by the Sound Generations breach?
If you got a letter dated December 2021, yes. If you used Sound Generations services and didn't get one, check its posted notice or ask the organization directly.
What was exposed?
Per the notice: names, addresses, phone numbers, email addresses, dates of birth and insurance status. Some EnhanceFitness participants also had health insurance numbers exposed.
Were Social Security numbers exposed?
Sound Generations says it doesn't collect or store them, so they weren't on the affected systems.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
