South Shore Hospital southshorehospital.com South Shore Hospital data breach: what happened and what to do
South Shore Hospital, a Chicago hospital, reported a cybersecurity incident that affected about 115,000 people. Unauthorized activity was spotted on its network on December 10, 2021. Exposed data included names, Social Security numbers, driver's license numbers and medical details.
View all 13,177 breaches- Breach date
- 10 Dec 2021
- Made public
- 7 Feb 2022
- Affected
- 115,175
- Data exposed
- Names, Physical addresses, Dates of birth, Driver's licenses, Social security numbers, Medical information, Lab results, Medications
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
South Shore Hospital in Chicago reported a cybersecurity incident to the U.S. Department of Health and Human Services (HHS). The hospital said unauthorized activity was happening on its network, according to SC Media's coverage, which puts the date it was alerted at December 10, 2021. The hospital cut its systems off from outside access, told law enforcement and investigated. The breach appeared on HHS's breach portal in early February 2022 with about 115,000 people affected.
Sources checked: ocrportal.hhs.gov, scworld.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
Per the HHS entry, the data included names, addresses, dates of birth, driver's license numbers, Social Security numbers, diagnoses and conditions, lab results and medications. Press reports give a slightly higher count than HHS, in the range of 115,000 to 116,000 people.
That mix matters. A Social Security number and date of birth are what a criminal needs to try to open credit in your name. Medical details give scammers believable material for phishing calls, emails and texts that claim to come from a provider or insurer.
The hospital's response
HHS records that the hospital notified affected people, the media and the regulator, posted a notice, and offered free credit monitoring. It also added administrative, technical and security safeguards.
What to do
If you received a letter, take the credit monitoring offer. Freeze your credit if your Social Security number was in the notice, and read your insurer's statements for care you didn't receive. If you can't tell whether you were affected, a free Serus scan checks your email and phone against breach databases.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
If your Social Security number or driver's license number was in your letter, place a free freeze at Equifax, Experian and TransUnion. The FTC explains how.
- 2
Take the free credit monitoring
Enroll using the code in your notice letter. Monitoring alerts you to new activity but doesn't block it, so a freeze is still worth doing.
- 3
Read your insurance statements
Look through explanation of benefits statements for treatment or prescriptions you didn't receive, and report anything odd to your insurer.
- 4
Be wary of messages that mention the breach
Expect calls, emails and texts that use your medical details to sound real. Don't click links; contact the hospital using a number from its own website.
- 5
Report misuse
If someone uses your identity, report it at IdentityTheft.gov to get a recovery plan.
Official filings
- U.S. Department of Health and Human Services , filed 7 Feb 2022 : 115,175 people
- U.S. Department of Health and Human Services , filed 23 Sept 2020 : 74,328 people
Timeline
-
Reported to U.S. Department of Health and Human Services
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the South Shore Hospital data breach?
People affected were notified by the hospital. If you were a patient and didn't get a letter, contact the hospital using the number on its official website.
What was exposed?
Names, addresses, dates of birth, driver's license numbers, Social Security numbers, diagnoses and conditions, lab results and medications, according to the HHS entry.
Should I freeze my credit?
If your Social Security number was exposed, yes. The FTC says a freeze is free and you can lift it whenever you need to apply for credit.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
