Wright & Filippis wrightfilippis.com Wright & Filippis data breach: what happened and what to do
Wright & Filippis, a Michigan prosthetics and orthotics provider, reported a January 2022 cyberattack that exposed the health information of 877,584 current and former patients, employees and job applicants, including names, dates of birth and Social Security numbers.
View all 13,177 breaches- Breach date
- 26 Jan 2022
- Made public
- 18 Nov 2022
- Affected
- 877,584
- Data exposed
- Names, Physical addresses, Dates of birth, Social security numbers, Claims information, Financial information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Wright & Filippis, a provider of prosthetics and orthotics, reported that attackers got into its systems in January 2022. Coverage of the filing says the company learned of the incident in May 2022 and described it as a ransomware attack. In November 2022 it told the U.S. Department of Health and Human Services (HHS) and the California Attorney General, and it began mailing notice letters on November 18, 2022.
HHS lists 877,584 people as affected. They include current and former patients, employees and job applicants, so you don't have to have been a patient to get a letter.
Sources checked: ocrportal.hhs.gov, hipaajournal.com, jdsupra.com
Last verified against the official page:
What was exposed
HHS says the data included names, addresses, dates of birth, Social Security numbers, and claims and financial information. Reports on the filing add patient numbers and health insurance details, and driver's license or state ID numbers for some employees and applicants.
A Social Security number plus a date of birth is what identity thieves need to open credit in your name or file a false tax return. Claims and insurance details also make convincing bait for phishing calls and letters that claim to be from your insurer or a medical provider.
The company's response
HHS records that Wright & Filippis put administrative, technical and security safeguards in place after the attack. Eight lawsuits over the breach were consolidated into one case, and a $2.9 million class action settlement has been proposed, according to HIPAA Journal. The company denied the allegations.
What to do if you were in it
- 1
Read your notice letter and note what it says was exposed
The letter lists which of your details were involved and may offer free credit monitoring or identity restoration. Use the offer if you have one.
- 2
Freeze your credit at all three bureaus
A credit freeze is free and stops new credit being opened in your name. Contact Equifax, Experian and TransUnion separately. The FTC explains how in its guide to credit freezes and fraud alerts.
- 3
Check your credit reports and insurance statements
Look for accounts you don't recognize and for medical or insurance claims you didn't make. The FTC recommends getting your free reports and reviewing them after a breach.
- 4
Report identity theft if you see it
If someone uses your information, report it at IdentityTheft.gov to get a recovery plan from the FTC.
- 5
Expect phishing that mentions your health provider or insurer
Don't give details to unexpected callers or texts. Contact your insurer using the number on your card.
- 6
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you, but it can't remove data from breaches.
Official filings
- U.S. Department of Health and Human Services , filed 18 Nov 2022 : 877,584 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Wright & Filippis breach?
If the company sent you a notice letter, yes. HHS lists 877,584 current and former patients, employees and job applicants.
What data was exposed?
HHS says names, addresses, dates of birth, Social Security numbers, and claims and financial information.
Is there a settlement?
HIPAA Journal reports a proposed $2.9 million class action settlement. The company denied the allegations. Check the settlement notice for current status and deadlines.
Should I freeze my credit?
If your Social Security number was involved, the FTC says a credit freeze is a strong step. It is free and doesn't affect your credit score.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- hipaajournal.com/877500-individuals-affected-by-ransomware-attack-on-prosthetics-orthotics-provider/
- jdsupra.com/legalnews/wright-filippis-files-notice-of-data-3499228
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
