A ServiceAid breach exposed 480,000 patients' names, Social Security numbers, and medical records from a New York health system. The breach happened in September 2024 but wasn't reported publicly until May 2025. Healthcare breaches hit 244 cases by mid-May 2025, a 25% jump from the previous year, with over 21 million records exposed.
Chapters
It looks like we have another sizable healthcare data breach, this time with ServiceAid, that affects 480,000 patients of Catholic Health, a New York healthcare system. Reported on May 5th, the exposure dates back to September of last year, with the detection being made in mid-November 2024. It's not clear why it took so long to notify customers and regulatory authorities. The good news is that according to ServiceAid's webpage, they have no indication of identity theft or fraud at this time. But given the fact that they were very delayed in notifying victims, I would not put a whole lot of trust in their transparency. The exposed personal data includes name, Social Security number, date of birth, medical records and account numbers, health treatment and insurance information, and also patients' email, username, and passwords. This is a big bundle of personally identifiable and health data that cybercriminals and fraudsters could use to victimize these patients. The ServiceAid breach is unfortunate, but if we pull back, we can see this is part of a larger disturbing trend in the healthcare sector with data breaches this year. In the US, for every breach of 500 or more records, healthcare providers are required to report the incident to the US Department of Health and Human Services. The high-level details of these incidents are then published to a public database. I'll put the link in the description. Year to date, we— and we're only in mid-May right now— records show 244 reported breaches. That is more than one breach a day just for the healthcare sector and represents a 25% increase in cases from last year's average. So far this year, over 21 million records have been exposed, according to Health and Human Services. Digging into the data, 194 of those were attributed to hacking or theft. That's 80%. Now, this is not good for the healthcare sector or the citizens of the United States that they serve. Healthcare breaches often expose very sensitive data that can be used for insurance fraud, identity theft, social engineering, digital extortion, online bullying, and many other nefarious activities. This is one reason that cybercriminals like to hack healthcare systems. The data is very valuable. Overall, the cybersecurity risks are increasing for the health— healthcare sector this year. Organizations must proactively improve their ability to prevent, detect, and respond to data breaches, not only in their systems, but also in their third-party vendors and service providers. If not, we will see more breaches and greater victimization of patients.
