Advanced Recovery Equipment & Supplies Data Breach: New York DME Provider Sends Breach Notification
On October 18, 2024, Advanced Recovery Equipment and Supplies, LLC (ARES), a New York City-based provider of durable medical equipment (DME) and recovery products, announced a significant data breach that occurred in 2023. The company filed a notice of the data breach with the U.S. Department of Health and Human Services Office for Civil Rights. This followed the discovery that an unauthorized party had accessed its network for approximately one month, between June 27, 2023, and July 28, 2023.
The Scope of the Data Breach
The unauthorized access resulted in the exposure of sensitive consumer information. The compromised data included a range of personal identifiers and sensitive health information. ARES’s data breach notification letters revealed that the exposed information could include:
- Names
- Social Security numbers
- Dates of birth
- Driver’s license or state identification numbers
- Credit or debit card information
- Usernames and passwords
- Medical information
- Health insurance information
The extent of the data breach varied depending on the individual consumer.
ARES’s Response to the Data Breach
Upon discovering the unauthorized access, ARES immediately launched a thorough investigation with the assistance of external cybersecurity professionals. The investigation concluded on October 18, 2024, confirming the unauthorized access and the specific data compromised. Following this, ARES began sending out data breach notification letters to all individuals affected by the incident. The company also posted a notice about the incident on its website.
If you received a data breach notification from ARES, it’s crucial to understand the potential risks and take proactive steps to protect yourself from identity theft and fraud. A data breach lawyer can provide valuable guidance on protecting your information and exploring your legal options. The article recommends seeking legal counsel to learn more about available recourse.
What Caused the Data Breach?
While the precise cause of the data breach remains under investigation and further details are expected, ARES’s filing with the Department of Health and Human Services and its website notice provide some initial insights. The unauthorized access occurred over a month-long period in 2023. The breach highlights the importance of robust cybersecurity measures for companies handling sensitive personal and medical information.
About Advanced Recovery Equipment & Supplies, LLC
ARES is a significant player in the DME market, employing over 25 people and generating approximately $5 million in annual revenue. The company serves doctors, physical therapists, and patients, providing a wide range of equipment for various body parts, including ankles, back, hips, knees, and shoulders. The data breach underscores the vulnerability of even established businesses to sophisticated cyberattacks.
The ARES data breach serves as a stark reminder of the importance of robust data security measures for all organizations, particularly those handling sensitive personal and health information. The incident highlights the potential consequences of data breaches and the need for proactive steps to mitigate risks and protect consumer data. The ongoing investigation and ARES’s response to the data breach will likely shape future data security practices within the DME industry and beyond. Individuals affected by the data breach should take immediate steps to protect their identities and consider seeking legal counsel.
