Sutter Health sutterhealth.org Sutter Health data breach: what happened and what to do
Sutter Health said a vendor, Welltok, was hit through the MOVEit file transfer flaw on May 30 and 31, 2023. About 845,441 Sutter patients were affected. Exposed data included names, addresses, dates of birth, health insurance data, diagnoses and treatment information.
View all 13,115 breaches- Breach date
- 30 May 2023
- Made public
- 3 Nov 2023
- Affected
- 845,441
- Data exposed
- Names, Physical addresses, Dates of birth, Health insurance information, Medical information, Treatment information
- Last updated
What happened
The breach did not happen on Sutter Health's own systems. Welltok, a company that runs patient communications for health systems, used MOVEit Transfer, a file transfer tool with a flaw that attackers exploited against many organizations in 2023. According to Sutter's notice, an unauthorized user got into the Welltok MOVEit server on May 30 and 31, 2023 and may have copied patient information.
Welltok's parent company told Sutter about it on September 22, 2023, and the final investigation report arrived on October 24. Sutter published its notice on November 3, 2023. Sutter and HHS put the number of Sutter patients affected at 845,441. The overall Welltok breach was much bigger: HHS lists 8,493,379 people across all of its clients.
What was exposed
Sutter's notice and press coverage describe names, addresses, dates of birth, provider names, health insurance data, treatment cost details, diagnoses and treatment information. Sutter said Social Security numbers and financial information were not affected.
That limits some risks. Without a Social Security number, opening credit in your name is harder. But the medical details are sensitive, and they make phishing believable. A message that mentions your doctor, your insurer or a recent treatment can look like it really comes from your health system.
The company's response
Sutter mailed letters to patients, offered complimentary credit monitoring, and retrained staff. HHS says Sutter and Welltok added security safeguards.
What to do
Read the letter if you got one and watch your insurance statements. The steps below cover the rest.
What to do if you were in it
- 1
Read your explanation of benefits
Check statements from your insurer for care you didn't receive. Health insurance data was involved, which can be used to bill treatment to your policy.
- 2
Be careful with messages that mention Sutter
Expect texts, emails and calls that cite your doctor, a bill or this breach. Don't click links in them. Open the Sutter patient portal by typing the address yourself.
- 3
Take the free credit monitoring if offered
Sutter offered complimentary credit monitoring in its letters. Follow the enrollment steps in your letter.
- 4
Consider a credit freeze anyway
Sutter said Social Security numbers weren't affected, so a freeze isn't urgent. It's still free at Equifax, Experian and TransUnion, and many people keep one on permanently.
- 5
Check whether your email or phone is in this and other breaches
A free Serus scan checks breach databases for your email and phone number and tells you what to do next. Serus can't remove breach data, but it alerts you when your details show up.
Frequently asked
Was I affected by the Sutter Health breach?
If you got a letter from Sutter Health in late 2023, yes. Sutter says about 845,441 patients were involved.
Was Sutter Health itself hacked?
No. The attack hit Welltok, a vendor that sends communications for Sutter and other health systems, through the MOVEit file transfer flaw.
Were Social Security numbers exposed?
Sutter said Social Security numbers and financial information were not affected. Names, addresses, dates of birth, health insurance data and treatment information were.
What about the larger Welltok breach?
HHS lists the full Welltok breach at 8,493,379 people. Sutter's 845,441 patients are one group within that total.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
