Utah Imaging Associates utahimaging.com Utah Imaging Associates data breach 2021: what happened and what to do
Utah Imaging Associates, a Utah radiology group, reported a ransomware incident that began August 29, 2021 and affected 582,170 people. Names, addresses, dates of birth, Social Security numbers, insurance details, diagnoses, lab results and medications were exposed.
View all 13,177 breaches- Breach date
- 29 Aug 2021
- Affected
- 582,170
- Data exposed
- Names, Addresses, Dates of birth, Social security numbers, Health insurance information, Diagnoses, Lab results, Medications
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Utah Imaging Associates (UIA) is a group of radiologists in Utah. Attackers first got into its network on August 29, 2021. The group discovered the incident on September 4, 2021 and remediated it the same day. Letters to affected people went out on November 18, 2021, more than two months after the intrusion.
UIA reported the incident to HHS as a ransomware incident affecting 582,170 people.
Sources checked: ocrportal.hhs.gov, bleepingcomputer.com, healthimaging.com
Last verified against the official page:
What was exposed
HHS lists names, addresses, birthdates, Social Security numbers, diagnoses, lab results and medications. Reporting on the notice letter also mentions health insurance policy numbers.
That combination is the kind criminals use for identity fraud. A Social Security number with a date of birth can be used to apply for credit, file a false tax return or open accounts. Medical details and insurance numbers can be used for medical identity theft, where someone gets care or bills an insurer under your name.
The company's response
UIA offered free credit monitoring and identity restoration services and added administrative, technical and security safeguards, according to HHS. Bleeping Computer reported that the group said it had seen no sign of the data being published online.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A credit freeze is free and stops lenders from opening new accounts in your name. Place one at Equifax, Experian and TransUnion, as the FTC explains. Your Social Security number and date of birth were both involved.
- 2
Use the free credit monitoring if you were offered it
The notice letter explains how to enrol, and there is a deadline. The FTC recommends taking free credit monitoring when a company offers it. Enrolment is separate from a freeze, so do both.
- 3
Read your insurance and medical statements
Check the statements from your health insurer and your imaging providers. Report treatment, claims or bills you don't recognize to the insurer, since someone may be using your details to get care.
- 4
Be wary of messages that mention the breach
Scammers use real details to sound credible. Don't click links or call numbers in unexpected texts, emails or calls about your scans or the breach. Go to the organization's own website instead. If you spot a scam, report it at IdentityTheft.gov.
- 5
Check whether your email or phone is in other breaches
Serus monitors breach databases and the dark web and alerts you when your details show up. Run a free scan to see where you stand. Our guide to what to do after a data breach covers the rest.
Official filings
- U.S. Department of Health and Human Services , filed 3 Nov 2021 : 582,170 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Utah Imaging Associates breach?
UIA sent letters to the 582,170 people HHS lists, starting November 18, 2021. If you had imaging done through UIA and didn't get one, ask the practice.
What was exposed?
Names, addresses, birthdates, Social Security numbers, diagnoses, lab results and medications, per HHS. Insurance policy numbers were also reported.
Should I freeze my credit?
The FTC says a credit freeze is free and blocks most new accounts in your name. Because Social Security numbers were involved, it's a sensible step.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- bleepingcomputer.com/news/security/utah-medical-center-hit-by-data-breach-affecting-582k-patients
- healthimaging.com/topics/health-it/enterprise-imaging/data-breach-radiology-practice-500000-patients
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
