Health system data breach due to Meta Pixel hits 3 million patients


Level 76
Thread author
Honorary Member
Top Poster
Content Creator
Apr 24, 2016
Advocate Aurora Health (AAH), a 26-hospital healthcare system in Wisconsin and Illinois, is notifying its patients of a data breach that exposed the personal data of 3,000,000 patients.

The incident was caused by the improper use of Meta Pixel on AAH's websites, where patients log in and enter sensitive personal and medical information.

Meta Pixel is a JavaScript tracker that helps website operators understand how visitors interact with the site, helping them make targeted improvements.

However, the tracker also sends sensitive data to Meta (Facebook) and is then shared with a massive network of marketers who target patients with advertisements that match their conditions.

This privacy breach has taken the U.S. by storm, as Meta Pixel is used by many hospitals in the country, exposing millions of people to third parties and sparking class action lawsuits against the responsible organizations.

In August 2022, U.S. healthcare provider Novant Health disclosed its improper use of Meta Pixel in its implementation of the 'MyChart' portal, exposing 1.3 million patients.

The 'MyChart' patient portal is also used by AAH, along with another platform named 'LiveWell,' both of which had active Meta Pixel trackers.
AAH's data breach notification says that the following information may have been exposed via Meta Pixel:
  • IP address
  • Dates, times, and locations of scheduled appointments
  • Proximity to an AAH location
  • Medical provider information
  • Type of appointment or procedure
  • Communications between MyChart users, which may have included first and last names and medical record numbers
  • Insurance information
  • Proxy account information
AAH reported that the breach affected 3 million people to the U.S. Department of Health, which listed it on its breach report portal.

The healthcare provider has disabled the Pixel tracker on all systems and is implementing safeguards to prevent a similar exposure from happening again.

Patients are advised to use their web browsers' tracker-blocking features or use incognito mode when logging in on medical portals. Those with a Facebook or Google account should review their privacy settings.

AAH has also compiled a FAQ page to help patients find answers to common questions about the data breach.

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.