Liberty Resources Data Breach Exposes Patient Social Security Numbers

On July 22, 2024, Liberty Resources discovered unauthorized access to its network, marking the start of a significant data breach that affected its systems. According to the notice submitted to the Massachusetts Attorney General and Liberty Resources’ public notice, the breach took place between July 8, 2024, and July 22, 2024, during which time an unauthorized third-party actor accessed and removed sensitive files from the company’s network. 27 residents in the state were impacted.

The group known as RHYSIDA claimed responsibility for the attack, which they publicized on their dark web portal on Aug. 15, 2024, stating they would publish the stolen data within a week and providing sample screenshots as proof.

The breach exposed a range of personally identifiable information (PII) and protected health information (PHI). The information included names, addresses, dates of birth, Social Security numbers, medical information and health insurance information. Liberty Resources stated the files removed from their network did contain sensitive client and employee data.

Liberty Resources confirmed the scope of the incident and the types of information involved by Sept. 25, 2025. The severity of the breach is heightened by the involvement of ransomware and the public threat to release stolen data, which increases the risk of identity theft and fraud for those affected.

Liberty Resources’s response

Liberty Resources is offering complimentary identity theft protection services through IDX. These services include credit and CyberScan monitoring, a $1 million insurance reimbursement policy and fully managed identity theft recovery services. Affected individuals are encouraged to enroll in these services using the instructions provided in the notice.

Given the nature of the breach, Liberty Resources recommends that all affected individuals remain vigilant by regularly reviewing financial account statements and credit reports for any unauthorized activity. Additional steps may include placing a fraud alert or security freeze on credit files and monitoring explanation of benefits statements from health insurance providers for unfamiliar activity.