Sutter Health MOVEit Vendor Breach (2023): 845K Patient Records Including Medical Diagnoses Exposed via Welltok

About Sutter Health

Sutter Health is a large not-for-profit integrated health system based in Sacramento, California, operating hospitals, clinics, and physician networks across Northern California and serving millions of patients. It maintains patient identity, clinical, insurance, and billing records across its facilities and works with third-party vendors for patient-engagement and administrative services.

Why They Hold Your Data

Integrated health systems collect patient identity, contact, insurance, billing, appointment, and clinical records across hospitals, clinics, and administrative operations.

Recent Developments

The patient data was exposed not through a direct attack on Sutter but via its patient-engagement vendor Welltok (Virgin Pulse) during the 2023 MOVEit zero-day campaign. Sutter disclosed the incident on November 3, 2023 and offered one year of credit monitoring; it was criticized for the roughly four-month delay. Litigation (Copans v. Sutter Health & Welltok) was consolidated into the federal In re MOVEit MDL.

Data Points Exposed

Breach Impact

Although Social Security and payment-card numbers were not in the Welltok dataset, the exposure of names, addresses, dates of birth, insurance and provider details, and diagnosis/treatment codes plus clinical metrics assembled a comprehensive medical dossier on roughly 845,000 patients. That breadth of PHI supports targeted medical identity theft, insurance fraud, and extortion, and the incident became a leading example of third-party vendor risk in healthcare.

Exploitation & Downstream Threats

• Medical identity fraud and insurance abuse using diagnosis, treatment, and insurance data | • Targeted extortion using clinical metrics and diagnosis codes | • Identity verification bypass using name + date of birth | • Targeted phishing and vishing referencing providers or treatment | • Doxxing and physical targeting from exposed home addresses

What You Should Do

1. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
2. Watch for medical-benefit fraud and health-themed phishing that references real provider relationships.
3. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
4. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).