UC Health uchealth.com UC Health data breach: what happened and what to do
UC Health, a Cincinnati health system, said employees fell for a phishing attack in July 2019. HHS lists 95,339 people affected. Names, dates of birth, Social Security numbers, medications and treatment information were involved.
View all 13,177 breaches- Breach date
- 6 Jul 2019
- Made public
- 4 Sept 2019
- Affected
- 95,339
- Data exposed
- Names, Dates of birth, Social security numbers, Medications prescribed, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
UC Health said an unauthorized person got into a limited number of employee email accounts after staff fell for a phishing email. The activity ran from July 6 to July 12, 2019, according to news reports of the health system's announcement. UC Health secured the accounts, hired a computer forensics firm and set up a call center for patients.
The breach was later listed with the U.S. Department of Health and Human Services (HHS), which reports that it affected 95,339 people.
Sources checked: ocrportal.hhs.gov, wcpo.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
According to HHS, the information in the accounts included names, dates of birth, Social Security numbers, medications prescribed and treatment information. UC Health said it could not tell whether anyone actually opened the emails or attachments, and it said it had no sign the data was misused.
What that means for you
A name, date of birth and Social Security number together are what a criminal needs to open credit in your name or file a fake tax return. Treatment and medication details can make a phishing message look convincing, for example a fake bill from a clinic. Watch for letters from UC Health and for texts or calls that mention the breach.
What UC Health did
HHS reports that UC Health notified affected people, the media and HHS, offered free credit monitoring, added safeguards and retrained its staff.
What to do if you were in it
- 1
Freeze your credit
Place a free credit freeze at Equifax, Experian and TransUnion. It stops new accounts being opened in your name. The FTC explains how freezes and fraud alerts work. Then check your reports at annualcreditreport.com.
- 2
Read your medical bills and insurance statements
Look for services you didn't receive. The FTC's data breach guidance covers what to do if someone uses your information.
- 3
Be careful with messages about the breach
Expect phishing that mentions UC Health, your care or a bill. Don't click links; contact the provider using a number you already trust.
- 4
Check whether your email or phone is in this and other breaches
A free Serus scan checks breach databases for your email and phone and shows what else is out there.
Official filings
- U.S. Department of Health and Human Services , filed 4 Sept 2019 : 95,339 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the UC Health breach?
UC Health said it would notify affected patients by mail. If you received a letter, your information was involved.
What was exposed?
HHS lists names, dates of birth, Social Security numbers, medications prescribed and treatment information.
Should I freeze my credit?
The FTC says a credit freeze is free and stops new accounts being opened in your name. Because Social Security numbers were involved, it is worth considering.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
