You've probably heard by now of a recent massive data breach that left the personal information of millions of Americans vulnerable to hacking groups and dark web marketplaces.
But that's not the only data leak you should be keeping an eye out for: Change Healthcare, a subsidiary of the behemoth global health company UnitedHealth, was subject to a significant cyberattack earlier this year.
About a third of Americans may have had their personal health information leaked to the dark web as a result, UnitedHealth CEO Andrew Witty told the U.S. House Committee on Energy and Commerce in May . The company has been notifying people affected on a rolling basis this summer.
Here's what to know about the Change Healthcare hack and how you can best protect yourself.
What is Change Healthcare?
Change Healthcare is one of the largest health payment processing companies in the world. It helps facilitate billing and insurance for thousands of health systems , including more than 50 hospitals, medical offices and pharmacies in Wisconsin.
The company is also a clearing house for 15 billion medical claims each year, accounting for nearly 40% of all claims, according to the House Committee on Energy and Commerce .
When and how did the Change Healthcare hack occur?
Change Healthcare became aware of ransomware — a software that blocks access to systems until the owner pays a ransom to the hacker — in its computer system on Feb. 21, according to the company's official statement .
The following month, the company confirmed that a "substantial quantity of data had been exfiltrated" from its systems between Feb. 17 and 20.
After calling Witty to testify in May, the House Committee on Energy and Commerce concluded the hack occurred because the company was not deploying multi-factor authentication in one of its systems.
What information was stolen in the Change Healthcare hack?
Change Healthcare said it cannot confirm exactly what information has been stolen for each affected person. However, if you were impacted, any of the following information may now be vulnerable:
- Contact and personal information (such as full name, address, date of birth, Social Security numbers, driver’s licenses or state ID or passport numbers, phone number and email)
- Health insurance information (such as primary, secondary or other health plans/policies, insurance companies, member/group ID numbers and Medicaid-Medicare-government payor ID numbers)
- Health information (such as medical record numbers, providers, diagnoses, medicines, test results, images, care and treatment)
- Billing, claims and payment information (such as claim numbers, account numbers, billing codes, payment cards, financial and banking information, payments made and balance due)
How to know if your information has been stolen
The best way to know if your information is stolen is to look out for a notification from Change Healthcare. Since June, the company has been notifying people who may have been affected by the attack, including through written letters.
Change Healthcare also recommended that people monitor their health and financial statements to check for any unfamiliar activity. Here are a few reports you should keep an eye on:
- Explanation of benefits statements received from your health plan
- Statements from your health care provider
- Bank and credit card statements
- Credit reports
- Tax returns
What should I do if my information was stolen?
There are a few steps you can take if you believe your information has been stolen, including some measures specifically recommended by Change Healthcare:
- Anyone who believes their information may have been impacted by this incident can enroll in two years of complimentary credit monitoring and identity protection services. CHC is paying for the cost of these services for two years.
- If you notice any health care services you did not receive listed on an explanation of benefits statement, contact your health plan or doctor to report it.
- If you notice any suspicious activity on bank or credit card statements or on tax returns, you should immediately contact your financial institution and credit card company.
- If you believe you have been a victim of identity theft, you can report it to Federal Trade Commission at identitytheft.gov .
More: Your personal info, Social Security number may be stolen. Here's what to know and what to do.
Should I freeze my credit?
A preventative step you can take against fraud is freezing your credit. A credit freeze limits access to your credit report, making it less likely that an identity thief can open new accounts in your name.
To place a freeze, you must contact each of the three major credit bureaus online, by phone or by mail. Agencies must freeze your credit report within one day when you submit it online or by phone, according to the General Services Administration. Freeze requests sent by mail must be enacted within three business days.
A freeze remains in place until you ask the credit bureau to temporarily lift or remove it. Agencies must lift the freeze within an hour if you request it be unfrozen online or by phone, and within three business days by mail.
Here's how to contact each credit bureau:
Equifax
- Online: Visit the Equifax Credit Freeze page .
- By phone: Call Equifax at 800-685-1111.
- By mail: Send a request to Equifax, P.O. Box 105788, Atlanta, GA 30348. Include your name, address, Social Security number and copies of documentation proving your identity (like a driver's license, utility bill or bank statement).
Experian
- Online: Visit the Experian Credit Freeze page .
- By phone: Call Experian at 888-397-3742.
- By mail: Send a request to Experian Security Freeze, P.O. Box 9554, Allen, TX 75013. Include your name, address, Social Security number and proof of identity.
TransUnion
- Online: Visit the TransUnion Credit Freeze page .
- By phone: Call TransUnion at 888-909-8872.
- By mail: Send a request to TransUnion, P.O. Box 160, Woodlyn, PA 19094. Include your name, address, Social Security number and proof of identity.
This article originally appeared on Milwaukee Journal Sentinel: The health info of about a third of Americans has been leaked. Wisconsinites could be affected
Local News
