Appointments leaked: what it means and what to do

Risk level: medium. Can you change it: no. Found in 1 breaches in this directory.

What this data is

Records of bookings you made: the date, the time, the location and often the service or practitioner. Common in clinic, salon, garage, legal and government service breaches.

The risk on its own

An appointment list is a pattern of life. It shows when you are away from home, where you go regularly and which services you use. Where the provider is a clinic or a specialist, the appointment type itself is effectively health information.

The risk combined with other data

With your name, phone number and address it becomes both a targeting tool and a physical safety issue. Scammers who can name your clinic, your date and your practitioner sound completely legitimate on the phone. For anyone hiding from an abusive ex partner, a recurring appointment is a place to be found.

How criminals use it

  • A caller quotes your real upcoming appointment and asks for a booking fee or a card number to confirm it.
  • A burglar reads that you have a long booking across town at a known time.
  • Sensitive appointment types, a fertility clinic, a psychiatrist, an addiction service, become material for extortion or gossip.
  • A stalker or an ex partner uses a recurring weekly booking to work out where you will be.

What to do now

  1. Call the provider on its published number, not a number from any message, and ask what was in the breach.
  2. Treat every message about appointments as unverified, and confirm changes only through the official app or number.
  3. Ask the provider to remove the service or reason field from future bookings if it is not medically necessary.
  4. If you have a safety concern about a specific person, tell the provider so they flag your record and never confirm details to callers.
  5. Change the password on the booking account and turn on two-factor authentication where it is offered.

Frequently asked questions

Is an appointment really sensitive?

It depends entirely on who you booked with. A haircut is trivial. A booking at a mental health, fertility or addiction service is health information about you.

How do I tell a real appointment reminder from a scam one?

Real providers do not ask for card details or a login through a reminder link. Open the official app or ring the clinic on its published number instead.

Can I ask for the history to be deleted?

You can ask, and non clinical providers usually agree. Health providers must keep clinical records for a legally set period, but they can restrict who sees them.

Breaches that exposed this data

  • MMG Fusion: 2020-12-20, 2.7M accounts, Appointments, Dates of birth, Email addresses, Genders, Marital statuses, Names

Tools that help

Related guides

Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.