Matthew RosenquistFounder & CISO Advisor, Cybersecurity Insights · CISO, Cybersecurity Strategist, & Industry Advisor

Serviceaide Data Breach is Part of a Larger Healthcare Trend

20 May 2025 · 3 min

Watch on YouTube

3:20

In this commentary, the speaker outlines a recent data breach at ServiceAid that exposed the personal and health information of approximately 480,000 patients of Catholic Health, a New York healthcare system. The breach began in September 2023, was detected in mid‑November 2024, and was not reported until May 5, 2025, raising concerns about delayed notification and transparency. Exposed data include names, Social Security numbers, dates of birth, medical records, account numbers, treatment and insurance details, as well as email addresses, usernames, and passwords. While ServiceAid reports no evidence of identity theft or fraud yet, the speaker emphasizes the high risk posed by such a comprehensive data set. The incident is framed within a broader, alarming trend: as of mid‑May 2025, the U.S. Department of Health and Human Services records show 244 healthcare breaches affecting over 21 million records—a 25 % increase over the previous year, with 80 % attributed to hacking or theft. The speaker explains why healthcare data is valuable to cybercriminals and warns that without proactive prevention, detection, and response—especially concerning third‑party vendors—more breaches and victimization are likely.

Chapters

It looks like we have another sizable healthcare data breach, this time with ServiceAid, that affects 480,000 patients of Catholic Health, a New York healthcare system. Reported on May 5th, the exposure dates back to September of last year, with the detection being made in mid-November 2024. It's not clear why it took so long to notify customers and regulatory authorities. The good news is that according to ServiceAid's web page, they have no indication of identity theft or fraud at this time. But given the fact that they were very delayed in notifying victims, I would not put a whole lot of trust in their transparency. The exposed personal data includes name, Social Security number, date of birth, medical records, and account numbers. Health treatment and insurance information, and also patients' email, username, and passwords. This is a big bundle of personally identifiable and health data that cybercriminals and fraudsters could use to victimize these patients. The ServiceAid breach is unfortunate, but if we pull back, we can see this is part of a larger disturbing trend in the healthcare sector with data breaches this year. In the US, for every breach of 500 or more records, healthcare providers are required to report the incident to the US Department of Health and Human Services. The high-level details of these incidents are then published to a public database. I'll put the link in the description. Year to date, we— and we're only in mid-May right now— Records show 244 reported breaches. That is more than one breach a day just for the healthcare sector and represents a 25% increase in cases from last year's average. So far this year, over 21 million records have been exposed according to Health and Human Services. Digging into the data, 194 of those were attributed to hacking or theft. That's 80%. Now, this is not good for the healthcare sector or the citizens of the United States that they serve. Healthcare breaches often expose very sensitive data that can be used for insurance fraud, identity theft, social engineering, digital extortion, online bullying, and many other nefarious activities. This is one reason that cybercriminals like to hack healthcare systems. The data is very valuable. Overall, the cybersecurity risks are increasing for the healthcare sector this year. Organizations must proactively improve their ability to prevent, detect, and respond to data breaches, not only in their systems, but also in their third-party vendors and service providers. If not, we will see more breaches and greater victimization of patients.