UConn Health health.uconn.edu UConn Health data breach: what happened and what to do
UConn Health reported that a phishing attack on an employee's email affected 326,629 people. Exposed data included names, addresses, dates of birth, driver's license and Social Security numbers, claims, financial and clinical information.
View all 13,177 breaches- Breach date
- 20 Aug 2018
- Made public
- 25 Feb 2019
- Affected
- 326,629
- Data exposed
- Names, Physical addresses, Dates of birth, Driver's licenses, Social security numbers, Claims information, Financial information, Clinical information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
UConn Health, the University of Connecticut's academic medical center, told the U.S. Department of Health and Human Services that an employee fell for a phishing email and an attacker reached the employee's email account. HHS lists 326,629 people as affected. UConn Health announced the incident publicly on 25 February 2019, according to HIPAA Journal.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What was exposed
HHS's description says the information included names, addresses, dates of birth, driver's license numbers, Social Security numbers, claims and financial information and clinical information. HIPAA Journal reported that Social Security numbers were involved for a small share of patients, so what leaked varied by person.
UConn Health notified HHS, the affected individuals and the media, and offered complimentary credit monitoring and identity protection services. It added technical safeguards and retrained staff on spotting fraudulent emails.
Why it matters
A date of birth with a Social Security number or driver's license number is what a criminal needs to try to open credit in your name. Claims and clinical details can fuel medical identity theft and convincing phone scams that pose as your insurer or provider.
If you received a notice letter, read it and take the credit monitoring if it's offered.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A credit freeze stops lenders from seeing your report, which blocks most new accounts opened in your name. The FTC says it's free, lasts until you lift it, and you place it separately at Equifax, Experian and TransUnion. Lift it only when you apply for credit yourself.
- 2
Read your statements and insurance explanations of benefits
Look for charges, accounts or treatment you don't recognize. If something is wrong, report it at IdentityTheft.gov, the FTC's reporting site, which also builds a recovery plan for you.
- 3
Take the offered credit monitoring
If you got a notice letter with free credit monitoring, the FTC recommends using it. Follow the sign-up steps in the letter, not links in an unexpected email.
- 4
Expect phishing that mentions the breach
Scammers use real details to sound legitimate. The FTC advises you not to click links or call numbers in unexpected messages; contact the organization using a number from its official website instead.
- 5
Check whether your email or phone is in this and other breaches
Serus runs a free scan against breach databases and the dark web and alerts you if your email or phone number shows up. Serus can't remove data from a breach, but it tells you when to change a password or watch for phishing.
Official filings
- U.S. Department of Health and Human Services , filed 21 Feb 2019 : 326,629 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
-
The company made it public
Frequently asked
Was I affected by the UConn Health breach?
If you were affected you should have received a notice letter. HHS lists 326,629 people as affected. You can also contact UConn Health to ask.
What was exposed?
Per HHS: names, addresses, dates of birth, driver's license numbers, Social Security numbers, claims and financial information and clinical information. It varied by patient.
Did UConn Health offer credit monitoring?
Yes. HHS's description says UConn Health provided complimentary credit monitoring and identity protection services.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
