6.4 Million Records from HHS Had Their Personal Data Exposed

On March 17, 2023, the U.S. Department of Health and Human Services (HHS) suffered a data breach that exposed approximately 6,494,914 records belonging to doctors and healthcare professionals. The compromised data included phone numbers, gender, and physical addresses, among other professional identifiers. This incident is partcularly significant given the scope of the affected population and the sensitivity of the professional information involved.

Why Exposed Healthcare Professional Data Puts People at Risk

When the personal and professional details of healthcare workers are leaked, the consequences extend beyond individual privacy. Criminals can use phone numbers, addresses, and professional credentials to impersonate doctors in fraud schemes, target them with spear phishing, or facilitate medical identity theft. The combination of address, gender, and phone data makes it accessable for bad actors to build convincing fake identities or manipulate victims directly.

What Was Exposed in the U.S. Department of Health and Human Services Breach

• Phone Number
• Gender
• Address

Why the HHS Breach Still Matters Today

Records containing professional contact information for healthcare providers are highly sought after on criminal markets due to their value in medical fraud and social engineering. The sheer scale of this breach, over 6.4 million records, means the data has almost certainly been incorporated into multiple threat actor toolkits. Healthcare professionals whose data was included in this breach should remain vigilant about unsolicited contact and verify any requests for sensitive information through official channels.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a site's backend data store, often through SQL injection, misconfigured access controls, or compromised credentials. Once inside, they can extract entire tables of user data in minutes. The resulting data is then packaged and sold or freely distributed on criminal forums.

Check If Your Data Was Exposed

HEROIC's breach search tool is backed by a database of over 400 billion exposed records, giving you the most comprehensive view of your personal exposure available anywhere. If your email appeared in the HHS breach or any other incident, HEROIC can tell you exactly what was leaked and help you take action to protect your accounts today.