Yuma Regional Medical Center yumaregional.org Yuma Regional Medical Center data breach: what happened and what to do
Yuma Regional Medical Center in Arizona reported a ransomware attack in 2022 that affected 738,145 people. Exposed data included names, addresses, dates of birth, Social Security numbers, medications, lab results, diagnoses and claims information.
View all 13,177 breaches- Breach date
- 21 Apr 2022
- Made public
- 9 Jun 2022
- Affected
- 738,145
- Data exposed
- Names, Physical addresses, Dates of birth, Social security numbers, Medications, Lab results, Diagnoses, Claims information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Yuma Regional Medical Center (YRMC), a hospital in Yuma, Arizona, said it found ransomware on some of its external systems on April 25, 2022. Its investigation found that an unauthorized party had access to the network for several days, between April 21 and April 25. The hospital's electronic medical record system was not affected.
YRMC told the U.S. Department of Health and Human Services that the attack affected the health information of 738,145 people. Press coverage at the time described letters going out to more than 700,000 people.
Sources checked: ocrportal.hhs.gov, hipaajournal.com, healthitsecurity.com
Last verified against the official page:
What was exposed
According to the federal filing, the information involved included names, addresses, dates of birth, Social Security numbers, medications, lab results, diagnoses and claims information. Some reports also list health insurance details. Not every person had every item exposed.
A Social Security number together with a date of birth and an address is what criminals need to open credit accounts or file tax returns in someone else's name. Medical details can be used in convincing phone or text scams that pretend to be your provider or insurer.
What the hospital did
YRMC posted a notice on its website, sent letters to affected people and offered complimentary identity theft protection and credit monitoring to eligible individuals. It said it added administrative and technical safeguards to better protect patient information. The letter included a phone number for people who had not received one.
If you were a YRMC patient around that time, read your letter closely and use the monitoring offer if it applies to you. Then follow the steps below.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A freeze is free and stops new credit accounts from being opened with your Social Security number. Contact Equifax, Experian and TransUnion. The FTC explains how at consumer.ftc.gov.
- 2
Use the credit monitoring offer
If your letter included a code for credit monitoring or identity theft protection, activate it. The FTC recommends taking such offers after a breach.
- 3
Read your explanation of benefits
Check statements from your insurer for treatments or claims you don't recognize. Report anything odd to the insurer.
- 4
Expect phishing that mentions your care
Be wary of calls, texts or emails about a hospital bill, insurance or the breach itself. Contact the provider using a number from its official website, not one in the message.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus to see where your email or phone number has shown up in known breaches.
Official filings
- U.S. Department of Health and Human Services , filed 9 Jun 2022 : 738,145 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Yuma Regional Medical Center breach?
If you received a notice letter from YRMC, yes. If you think you were a patient but got no letter, call the contact number in the hospital's security incident notice.
What data was exposed?
Names, addresses, dates of birth, Social Security numbers, medications, lab results, diagnoses and claims information, according to the federal filing.
How many people were affected?
YRMC reported 738,145 people to the U.S. Department of Health and Human Services.
Should I freeze my credit?
Because Social Security numbers were involved, a credit freeze is a sensible step. It is free and the FTC recommends it when your Social Security number is exposed.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- hipaajournal.com/700000-patients-affected-by-yuma-regional-medical-center-ransomware-attack/
- healthitsecurity.com/news/yuma-regional-medical-center-experiences-ransomware-attack
- identitytheft.gov/databreach
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
Something wrong or out of date? Tell us and we'll re-check it.
