Date reported to HHS OCR: July 19, 2024

Location: Arkansas

Individuals affected: 375,436

The behavioral healthcare provider was hit by a cybersecurity incident in March, and some files containing personal information may have been accessed or stolen, according to a breach notice. 

Data exposed could include names, contact information, birth dates, Social Security numbers, driver’s license numbers, medical record numbers, health insurance numbers or member IDs, certification of substance abuse program completion, and medical history and diagnoses.

Date reported to HHS OCR: June 27, 2024

Location: Illinois

Individuals affected: 775,860

Lurie was hit by a cyberattack in late January 2024, forcing the Chicago children’s hospital to shut down its email, phones and electronic health record. The provider completed its recovery in late May.

An investigation found no evidence that cybercriminals had accessed EHR data, but information found in other Lurie systems was compromised.

Data exposed could include names, addresses, birth dates, Social Security numbers, dates of service, email addresses, telephone numbers, driver’s license numbers, health plan details, and medical and prescription information.

Date reported to HHS OCR: June 21, 2024

Location: Pennsylvania

Individuals affected: 1,276,026

In late November, the Pennsylvania-based health system discovered a former employee of Nuance Communications, a Microsoft-owned clinical documentation vendor, had accessed certain patient information two days after the employee had been terminated, according to a Geisinger press release.

The former worker was arrested and faces federal charges. 

Data exposed varied by patient, but could include names, birth dates, addresses, admit and discharge or transfer codes, medical record numbers, race, gender, phone numbers and facility names.

Date reported to HHS OCR: June 14, 2024

Location: Minnesota

Individuals affected: 583,824

The radiology practice detected suspicious activity on its network in February, according to a breach notice filed with Maine’s attorney general. 

Data exposed could include names, addresses, birth dates, Social Security numbers and health insurance and medical information.

Date reported to HHS OCR: June 5, 2024

Location: Colorado

Individuals affected: 377,911

An unauthorized party accessed the vision care practice management company’s network between late May and early June 2023 and may have stolen files, according to a breach notification. 

Data exposed could include names, contact information, Social Security or other identification numbers, banking details, medical information and online account access information. Not all data was affected for all individuals, according to Panorama.

Date reported to HHS OCR: May 24, 2024

Location: Nebraska

Individuals affected: 2,812,336

The pharmacy benefit manager determined an unauthorized party accessed and stole information from some non-clinical systems in early October, according to a breach report. 

An investigation found that data taken from Sav-Rx’s IT system was destroyed and not further disseminated. 

Data exposed could include names, birth dates, Social Security numbers, contact information, eligibility data and insurance identification numbers. 

Date reported to HHS OCR: May 17, 2024

Location: Texas

Individuals affected: 400,000

The San Antonio, Texas-based primary care provider detected unusual activity on its network in early May, according to a breach notification.

Data exposed could include patient names, addresses, birth dates, Social Security numbers, financial account information, medical record numbers, health insurance information and diagnosis and treatment information.

The attack marks the second data breach at CentroMed in the past year. In August 2023, the provider reported a breach that may have exposed information from 350,000 people, according to filings with federal regulators. 

Date reported to HHS OCR: May 10, 2024

Location: Illinois

Individuals affected: 858,238

The Midwestern emergency services provider detected unusual activity on its computer systems in May 2023, and about a month later determined an unauthorized party had copied files from its network, according to a breach notification. 

Data exposed could include patient names, addresses, birth dates, Social Security numbers, ID numbers, financial account and payment information, patient record details and health insurance information.

Date reported to HHS OCR: May 8, 2024

Location: Texas

Individuals affected: 2,518,533*

The health plan administrator detected evidence of suspicious activity on its network at the end of December, according to a breach report. An investigation later determined an unauthorized person may have taken personal information from its systems in April 2023.

Data exposed could include names, contact information, dates of birth, dates of death, Social Security numbers and insurance information.

*Updated June 20, 2024

Date reported to HHS OCR: May 3, 2024

Location: New Jersey

Individuals affected: 380,000

The dermatology provider was hit by a ransomware attack in early March, and an investigation later found an unauthorized person had copied patient and employee data from its network, according to a breach notification.

Names, dates of birth, mailing addresses and Social Security numbers could be exposed for both patients and employees.

Additionally, medication treatment and health insurance claims information could be compromised for the practice’s patients, while employees’ driver’s license numbers and passport numbers could be exposed.

Date reported to HHS OCR: May 1, 2024

Location: Tennessee

Individuals affected: 602,265

Numotion, which makes wheelchairs and other mobility products, detected suspicious activity on its network in early March, and later learned files may have been taken from its systems, according to a breach notification.  

Data exposed could include customer names, birth dates, equipment order details, supporting medical documentation and insurance information. For a smaller group of people, driver’s license or Social Security numbers could be compromised. 

Date reported to HHS OCR: April 12, 2024

Location: California

Individuals affected: 13,400,000

The plan, one of the largest healthcare organizations in the country, found “certain online technologies” previously used on its website and apps may have sent data to third parties like Google and Microsoft, Kaiser said in a statement to Healthcare Dive. 

Information exposed could include members’ names and IP addresses, whether they’re signed into a Kaiser account or service and details about how patients use the applications.

Date reported to HHS OCR: April 8, 2024

Location: Wisconsin

Individuals affected: 533,809

In January, the nonprofit health plan discovered that someone without authorization had accessed its network, according to an incident report.

Data exposed could include names, addresses, telephone numbers, e-mail addresses, dates of birth and/or death, Social Security numbers, member numbers and Medicare and/or Medicaid numbers, according to a press release.*

*Updated April 10, 2024

Date reported to HHS OCR: March 28, 2024

Location: Pennsylvania

Individuals affected: 618,189

The dental care provider, which has locations in Arizona, Colorado, Texas, and Nevada, detected unusual activity on its system in July 2023, according to a breach notification. In October 2023, an investigation found some files had been downloaded without authorization. 

Data exposed could include patient names, contact information, treatment information, the initial date or dates of service and/or insurance subscriber information.

Date reported to HHS OCR: March 22, 2024

Location: Oklahoma

Individuals affected: 611,743

EMSA, an Oklahoma-based ambulance and emergency care provider, identified suspicious activity on its network in mid-February, according to a breach notification. 

An investigation determined an unauthorized party had taken patient files between Feb. 10 and Feb. 13.

Exposed data could include names, addresses, birth dates, service dates and, for some, names of primary care providers and Social Security numbers.

Date reported to HHS OCR: March 4, 2024

Location: Pennsylvania

Individuals affected: 457,152

The medical device maker was notified about a vulnerability in its MOVEit file transfer software in early June, according to a breach notification. An investigation later determined an unauthorized person had used the vulnerability to take files on May 31.

Data exposed could include names, addresses, birth dates, email addresses, phone numbers, patient and facility identification numbers, device serial numbers, modem serial numbers, physicians and device usage information.

Suppliers who work with Philips also said health insurance policy numbers and device setup dates could have been disclosed by the breach. 

Date reported to HHS OCR: Feb. 29, 2024

Location: North Carolina

Individuals affected: 886,746

The Greenville, North Carolina-based radiology practice first found suspicious activity on its network in late November, according to a breach notification. An investigation completed early this year determined an unauthorized person had accessed or copied some of the imaging provider’s documents.

Data exposed could include patients’ names, contact information, Social Security numbers, insurance information, exam and/or procedure information, referring physicians, diagnosis information and/or imaging results.

Date reported to HHS OCR: Feb. 23, 2024

Location: New York

Individuals affected: 791,273

Unite Here, a labor union that represents workers in Canada and the U.S., discovered a third party had accessed its systems at the end of October, according to a data breach notification.

Personal information from some local union or health fund members may have been exposed, including names, Social Security numbers, driver’s licenses, state identification numbers, alien registration numbers, tribal identification numbers, passport numbers, birth certificates, birth dates, marriage licenses, signatures, financial account information and medical information.

Date reported to HHS OCR: Feb. 6, 2024

Location: Arizona

Individuals affected: 2,350,236

American Vision Partners, which offers administrative support to ophthalmology practices, detected unauthorized activity on parts of its network in November, and weeks later determined a third party could have obtained patient information, according to a press release.

Data exposed could include names, contact information, birth dates and medical details like services received, clinical records and medications. Social Security numbers and insurance information could be involved in some cases.

Date reported to HHS OCR: Jan. 26, 2024

Location: Oklahoma

Individuals affected: 2,385,646

The Oklahoma-based health system determined some of its files were accessed or acquired by an unauthorized party in late November, according to a breach notification. 

About a month later, Integris learned some patients were being contacted by a group that claimed responsibility for the breach. Lawsuits filed against the health system alleged cybercriminals had been trying to extort patients directly, according to news reports. 

Data exposed could include names, birth dates, contact information, demographic information and Social Security numbers. 

Date reported to HHS OCR: Jan. 9, 2024

Location: Texas

Individuals affected: 3,998,163*

Concentra learned about a data security incident at medical transcription firm Perry Johnson & Associates that could impact some of its patients in November, the occupational healthcare provider said in a breach notification. 

PJ&A had previously reported that an unauthorized person had gained access to its network between late March and early May. 

Data exposed varied by individual, but it could include names, birth dates, addresses, medical record numbers, hospital account numbers, admission diagnoses and dates and times of service, the vendor said. Social Security numbers, insurance details and clinical information could be affected for some people.

*Updated March 13, 2024

Date reported to HHS OCR: Jan. 3, 2024

Location: Missouri

Individuals affected: 502,438

North Kansas City Hospital learned in July that a medical transcription services vendor, Perry Johnson & Associates, discovered a third party had accessed some of its systems, according to a breach notification. 

The hospital worked with PJ&A through November to determine how many people could have been affected and what data was involved. 

Information exposed could include patient names, birth dates, gender, phone numbers, addresses, health insurance information and some clinical information. Social Security numbers weren’t affected. 

Date reported to HHS OCR: Dec. 31, 2023

Location: Massachusetts

Individuals affected: 911,757

Fallon, a medical transportation company that shut down in December 2022, detected suspicious activity in a data storage archive in April, according to a breach notification letter. 

An investigation determined an unauthorized party may have accessed archived data between February and April. 

Data exposed could include names, addresses, Social Security numbers, medical information and information related to employment or job applications.

Date reported to HHS OCR: Dec. 28, 2023

Location: Florida

Individuals affected: 542,990

The medical device company detected unusual activity on some of its systems in May, and later determined an unknown actor had access to certain parts of its network, according to a breach notification. 

Data exposed could include names, addresses, email addresses, phone numbers, diagnoses and insurance information, as well as subscriber numbers and products prescribed and billed.

Date reported to HHS OCR: Dec. 22, 2023

Location: Washington

Individuals affected: 890,959

The nonprofit cancer center, which works with University of Washington Medicine, detected unauthorized activity on parts of its clinical network in November, according to a breach notification.

An investigation determined a criminal group, likely based outside the U.S., accessed and obtained patient information between Nov. 19-25.

Data exposed could vary by individual and include names, addresses, phone numbers, email addresses, birth dates, Social Security numbers, health insurance information, medical record number, patient account number and dates of service. Certain clinical information such as treatment or diagnosis, lab results or provider name may also have been exposed.

Date reported to HHS OCR: Dec. 22, 2023

Location: Maryland

Individuals affected: 455,935

The ophthalmology group struggled to access information on some of its systems in March, and determined it had been targeted in a cybersecurity attack, according to a breach notice. 

Data exposed could include patient names, Social Security numbers, driver’s license or other government ID numbers, medical record numbers, addresses, telephone numbers, email addresses, birth dates and service dates as well as health, payment or insurance information.

Date reported to HHS OCR: Dec. 21, 2023

Location: New Jersey

Individuals affected: 4,656,293*

HealthEC, which offers a population health management platform for health systems and other healthcare organizations, determined an unknown party had accessed some of its systems in July, according to a breach notification. 

Data exposed could include names, addresses, birth dates, Social Security numbers, taxpayer ID numbers, medical record numbers, medical information, health insurance information and/or billing and claims information.

*Updated April 9, 2024

Date reported to HHS OCR: Dec. 20, 2023

Location: Tennessee

Individuals affected: 569,022

The radiology group reported it was the victim of a “cybersecurity incident” in late October.

It is still analyzing what types of data were exposed, according to a breach notification.

Date reported to HHS OCR: Dec. 18, 2023

Location: Texas

Individuals affected: 2,700,000

ESO, a software vendor for emergency services and hospitals, detected a “sophisticated” ransomware attack in late September, according to a breach notification. 

An unauthorized thirty party accessed and encrypted some of the vendor’s computer systems, and could have acquired personal and protected health information.

Data exposed could include names, birth dates, details about injuries and treatment as well as Social Security numbers for some people, according to a letter filed with Maine’s Attorney General.

Date reported to HHS OCR: December 12, 2023

Location: California

Individuals affected: 902,540

The cancer care provider detected suspicious activity on some of its systems in October 2023, according to a breach notification.  

Data exposed could include names, contact information, birth dates, Social Security numbers, driver’s license or other government identification, financial details, health insurance information, medical information and unique City of Hope identifiers.

Date reported to HHS OCR: Dec. 1, 2023

Location: Arizona

Individuals affected: 484,000

The Phoenix-area cardiovascular care provider discovered in late September that some of its computer systems experienced a cyberattack, according to a breach notice. 

An investigation determined that an attacker had accessed certain systems, encrypted information and stolen some of the provider’s data starting on or before Sept. 27.

Data exposed could include patient names, birth dates, emergency contact information, Social Security numbers, driver’s license and state ID numbers, insurance policy information, diagnosis and treatment details and other information from medical or billing records. 

Information from account guarantors and insurance policy holders could also have been exposed. 

Date reported to HHS OCR: Nov. 22, 2023

Location: New York

Individuals affected: 605,809

East River Medical Imaging, which provides diagnostic imaging and radiology in New York City and Westchester County, identified suspicious activity on its network in late September.

An investigation found an unauthorized person had accessed or copied some documents on its system between late August and late September, according to a breach notification.

Patient data exposed could include names, contact information, insurance information, exam and procedure information, referring physicians, imaging results and Social Security numbers. For employees, names, contact information, financial account information, Social Security numbers and driver’s license numbers could be breached. 

Date reported to HHS OCR: Nov. 21, 2023

Location: Maine

Individuals affected: 2,068,426

A vendor that works with BerryDunn’s healthcare analytics group notified the firm in September 2023 it had detected suspicious activity on its network, according to a breach notification.

Data exposed could include names, birth dates, Social Security numbers, health insurance policy numbers, Medicare or Medicaid numbers, state or government ID numbers, passport numbers and medical information.

Date reported to HHS OCR: Nov. 20, 2023

Location: Washington

Individuals affected: 437,392

Proliance Surgeons, which operates surgical centers, rehabilitation clinics and urgent care centers in Washington state, was hit by a cyberattack early this year, according to a breach notification. 

The provider learned in the spring that personal health information may have been accessed by an unauthorized person in February.

Data exposed could include names, birth dates, Social Security numbers, medical treatment information, health insurance information, phone numbers, email addresses, financial account numbers, driver’s license or other ID information, and usernames and passwords.

Date reported to HHS OCR: Nov. 17, 2023

Location: California

Individuals affected: 636,849*

California Physicians' Service, which operates as Blue Shield of California, is the latest healthcare organization to have its data breached due to a vulnerability in MOVEit file transfer software.

Blue Shield of California (BSCA) received notice in September that vision benefits administrator Medical Eye Services had experienced a MOVEit-related data breach. The vendor determined that an unauthorized third party accessed and removed data from its server in late May, according to a press release.

BSCA members' personal information may have been exposed, including name and address, along with more sensitive data like Social Security numbers and vision-related treatment and diagnosis information, according to BSCA. BSCA is one of the largest health plans in California, covering 4.8 million people in the state.

*Updated Feb. 20, 2024

Date reported to HHS OCR: Nov. 16, 2023

Location: Maine

Individuals affected: 376,504*

State agencies in Maine fell victim to a data breach in May, after criminals exploited a vulnerability in file transfer software MOVEit to access and download files.

The attack affected about 1.3 million people in total. More than half of the impacted individuals’ data came from the Maine Department of Health and Human Services.

The exposed data, which varied by person, could include names, Social Security numbers, birth dates, driver’s license or state ID numbers, taxpayer identification numbers and certain types of medical information and health insurance information.

*Updated April 1, 2024

Date reported to HHS OCR: Nov. 14, 2023

Location: New York

Individuals affected: 377,931

MESVision, which manages vision benefits for employers and insurers, discovered an unauthorized person had accessed information in its MOVEit file transfer server in late August. 

An investigation determined data had been taken from the server at the end of May, according to a breach notification. Blue Shield of California also reported in November that its members’ data could have been affected by the breach at the vendor. 

Data exposed could include names, birth dates, Social Security numbers, addresses, subscriber or Member ID numbers, policy numbers, group numbers and claim numbers.

Date reported to HHS OCR: November 10, 2023

Location: New Jersey

Individuals affected: 436,198

The consulting firm, a vendor for health system Prime Healthcare, was affected by a vulnerability in the MOVEit file transfer software, according to a breach notification. Prime received files of patients involved in September 2023.

Data exposed could include names, birth dates, addresses, medical record numbers, Social Security numbers, admission dates and discharge dates.

Date reported to HHS OCR: Nov. 6, 2023

Location: Colorado

Individuals affected: 14,762,475*

Welltok, a patient engagement company owned by tech firm Virgin Pulse, determined in August that an unauthorized person had exploited software vulnerabilities in the MOVEit file transfer server and taken data in late May, according to a breach notification.

Information exposed could include names, addresses, telephone numbers and email addresses. Some clients’ Social Security numbers, Medicare or Medicaid ID numbers, certain health insurance information, provider names, prescription names or treatment codes may have also been included.

*Updated Aug. 5, 2024

Date reported to HHS OCR: Nov. 3, 2023

Location: Nevada

Individuals affected: 8,952,212

PJ&A, which provides medical transcription services, discovered an unauthorized party was able to gain access to its network between late March and early May, according to a breach notice.

Data exposed could include names, birth dates, addresses, medical record numbers, hospital account numbers, admission diagnoses and dates and times of services. Social Security numbers, insurance information, clinical information from transcription files, and provider and facility names were also affected for some people.

Systems like Cook County Health and Northwell Health have disclosed their patients were affected by the breach.

Date reported to HHS OCR: Nov. 3, 2023

Location: California

Individuals affected: 845,441

The Sacramento, California-based health system was notified in late September that a vendor, Virgin Pulse subsidiary Welltok, was a victim of a ransomware attack targeting the MOVEit file transfer system.

Virgin Pulse told Sutter an unknown actor accessed the transfer server between May 30 and 31. Social Security numbers and financial information weren’t exposed in the incident, Sutter said.

Date reported to HHS OCR: Oct. 30, 2023

Location: California

Individuals affected: 2,364,359

Mail-order pharmacy Truepill has disclosed to the government that a bad actor accessed some files used for pharmacy management and fulfillment between Aug. 30 and Sept. 1.

Exposed information could include patient names, medication type, demographic information and names of prescribing physicians, according to a data breach notice. Social Security numbers weren’t involved, the company said.

Date reported to HHS OCR: October 24, 2023

Location: Minnesota

Individuals affected: 767,670

The digestive care provider detected unauthorized activity on its technology environment in August 2023, according to a breach notification. 

MNGI began an investigation into which data was compromised in the breach, which was completed in early June 2024. The company began notifying affected individuals in July.

Data exposed could include names, Social Security numbers, driver’s license or state identification numbers, passport numbers, birth dates, medical information and health insurance information, payment card information and account numbers.

Date reported to HHS OCR: Sept. 29, 2023

Location: Florida

Individuals affected: 1,975,066

Revenue cycle management firm Arietis determined in late July that unauthorized users accessed its MOVEit file transfer server in May and may have taken files belonging to its client, NorthStar Anesthesia, according to a breach notice. 

Information exposed may have included patient names, birth dates, driver’s license or other state identification card numbers, addresses, Social Security numbers, medical record numbers, patient account numbers, health insurance information and more.

Date reported to HHS OCR: Sept. 29, 2023

Location: New York

Individuals affected: 630,755

IBM manages the application and third-party database that support Janssen CarePath, a patient support and medication savings platform. Janssen discovered that unauthorized users were able to access the database, and IBM determined in early August that there had been unauthorized use of an unspecified extent, according to a press release. 

Data exposed could include names, contact information, birth dates, health insurance information and data about medications and associated health conditions. 

Date reported to HHS OCR: Sept. 29, 2023

Location: California

Individuals affected: 1,309,096

Prospect, which operates hospitals and other healthcare facilities in multiple states, was hit by a ransomware attack over the summer. 

The operator determined unauthorized parties had accessed and taken files that contained personal information from certain health plan members and patients between July 31 and August 3, according to a breach notification.

Data exposed varies by person, but it could include names, addresses, birth dates, diagnoses, lab results, medications, treatment information, health insurance information, provider names, facility names, dates of treatment. For some people, Social Security numbers, driver’s license numbers or financial information were exposed.

Date reported to HHS OCR: Sept. 22, 2023

Location: Missouri

Individuals affected: 2,824,726

The firm, which provides population health management services, was hit by a cyberattack in July 2023, according to a breach notification. An investigation determined the attacker accessed some systems that contained personal and protected health information.

Data exposed could include names, birth dates, health plan information, treatment details, provider information, health record details and Social Security numbers.

Date reported to HHS OCR: Sept. 18, 2023

Location: Virginia

Individuals affected: 1,229,333

The department manages the state’s Medicaid program that covers more than 1.5 million Virginians.

Date reported to HHS OCR: Sept. 15, 2023

Location: Massachusetts

Individuals affected: 1,225,054

Nuance, which makes speech recognition and AI notetaking software, determined that an unauthorized third party took data from its MOVEit software transfer environment at the end of May, according to a breach notification.

Information exposed could include birth dates, medical record numbers and gender information, as well as information about radiology studies received, including the practitioner’s name, healthcare facility name, dates of service provided, descriptions of service and the study report.

Date reported to HHS OCR: Sept. 15, 2023

Location: Pennsylvania

Individuals affected: 431,563*

The Philadelphia-based health system operates six hospitals and employed more than 10,000 faculty memebers and employees in 2020.

*Updated July 12, 2024

Date reported to HHS OCR: Aug. 25, 2023

Individuals affected: 1,229,333

Location: Iowa

Purfoods identified suspicious account behavior in February, and determined the meal delivery service had experienced a cyberattack between Jan. 16 and Feb. 22, according to a breach notification. The company began notifying impacted individuals by mail on Aug. 25, according to Purfoods.

Information exposed could include birth dates, driver’s license or state identification numbers, financial account information, payment card information, medical record numbers, Medicare and Medicaid identification and more.

Social Security numbers were breached for a small portion of the population, the company said.

Date reported to HHS OCR: Aug. 18, 2023

Location: New York

Individuals affected: 516,985

Some WellNow practices were hit by a ransomware attack in April, according to a statement provided to Healthcare Dive by a spokesperson from parent company The Aspen Group, or TAG.

TAG determined in December that an authorized party may have accessed some individuals’ files, the firm said in a Feb. 26 filing with Maine’s Attorney General. TAG began sending letters to impacted patients and employees in late February. 

The ransomware attack also affected another TAG business, Aspen Dental Management, the company disclosed separately to the government. That breach impacted 62,183 people.

Date reported to HHS OCR: Aug. 17, 2023

Location: Ohio

Individuals affected: 1,170,094

The marketing firm determined an unknown actor accessed and stole data from its MOVEit file transfer server in late May 2023, according to a breach notification. 

Date reported to HHS OCR: Aug. 17, 2023

Location: Texas

Individuals affected: 599,367

The Harris Center, the public mental health and intellectual developmental disability authority for Harris County in Texas, learned in June that third parties had exploited a vulnerability in one of its service providers’ MOVEit file transfer system, according to a breach notice. 

A review completed in early August determined documents exposed included information like names, addresses, birth dates, Social Security numbers, health insurance information and protected health information.

The Harris Center began sending written notification to impacted individuals on Aug. 17.

Date reported to HHS OCR: Aug. 15, 2023

Location: Oregon

Individuals affected: 1,752,076

PH Tech, a vendor that works with health plans to provide customer service, enrollment and payment services, determined in June that an unauthorized person used a vulnerability in the MOVEit file transfer software to download some of its data, according to a breach notification. 

Information exposed have have included names, birth dates, Social Security numbers, addresses, member ID numbers, plan ID numbers, email addresses, authorization information, diagnosis codes, procedure codes and claim information.

Date reported to HHS OCR: Aug. 11, 2023

Location: Colorado

Individuals affected: 4,091,794

The agency, which oversees the state’s Medicaid, Children’s Health Insurance Program and other healthcare projects, found in June that some of its files on vendor IBM’s MOVEit file transfer software were accessed by an unauthorized party, according to a news release. 

Information exposed may have included full names, Social Security numbers, Medicaid and Medicare ID numbers, birth dates, home addresses and other contact information, demographic or income information, health insurance information and clinical information.

Date reported to HHS OCR: Aug. 9, 2023

Location: Virginia

Individuals affected: 423,824

The department manages the state’s Medicaid program that covers more than 1.5 million Virginians.

Date reported to HHS OCR: Aug. 7, 2023

Location: Missouri

Individuals affected: 739,884

IBM Consulting, a vendor for the state’s Medicaid agency, informed the department in early June about a data security incident related to its MOVEit file transfer software, according to a release. 

Information involved may have included names, department client numbers, birth dates, possible benefit eligibility status or coverage and medical claims information.

Date reported to HHS OCR: Aug. 4, 2023

Location: Virginia

Individuals affected: 9,179,226*

Maximus is a contractor with federal, state and local governments and administers health and human services programs. 

*Updated April 1, 2024

Date reported to HHS OCR: Aug. 4, 2023

Location: Minnesota

Individuals affected: 600,794

Radius, which provides revenue cycle management services, learned about a vulnerability in the MOVEit file transfer software in early June and determined some of its documents were accessed, according to a notice. 

Data exposed may have included names, birth dates, Social Security numbers, patient treatment codes, treatment location and treatment payment history, including names of health insurers. 

Date reported to HHS OCR: Aug. 3, 2023

Location: Tennessee

Individuals affected: 531,732

Unum Group, which sells insurance products, detected suspicious activity involving the MOVEit file transfer software in early June, according to an incident report. 

Data involved may have included names, birth dates, addresses, Social Security numbers or individual tax identification numbers and medical, health insurance claim and policy information. Financial information and other government-issued identification numbers were involved for a limited number of people, according to the notice. 

Date reported to HHS OCR: July 31, 2023

Location: Tennessee

Individuals affected: 11,270,000

HCA Healthcare, one of the largest health systems in the country, found that a list with patient information was posted online by an unauthorized party in early July, according to a breach notification. The patient details appeared to be stolen from an external storage location used to format email messages. Individuals affected include patients who received care at HCA facilities in 20 states. 

The exposed files included patient names, city, state and zip code information, email addresses, telephone numbers, birth dates, gender, service dates, locations and possibly dates of patients’ next appointments. 

Date reported to HHS OCR: July 28, 2023

Location: Pennsylvania

Individuals affected: 689,686

Allegheny County, which includes Pittsburgh, reported a vulnerability in the MOVEit file transfer software was used to access and download county files in late May, according to a breach notice. 

Data exposed may have included names, Social Security numbers, birth dates, driver’s license or state identification numbers, taxpayer identification numbers, student identification numbers, certain types of medical information, health insurance information and billing and claims information.

Date reported to HHS OCR: July 28, 2023

Location: Maryland

Individuals affected: 2,342,357

The CMS, the U.S. federal health agency that provides coverage to more than 160 million people, reported that a data breach at federal contractor Maximus Federal Services related to a vulnerability in the MOVEit file transfer software could have exposed Medicare beneficiaries’ personal information and protected health information.

In November, the agency announced that the breach may have impacted an additional 330,000 people who currently have Medicare.The CMS estimates that the MOVEit breach impacted about 943,000 living beneficiaries, a spokesperson told Healthcare Dive. The number listed on the OCR database includes all beneficiaries whose data was included in the MOVEit files.

Data exposed may have included names, Social Security numbers or individual taxpayer identification numbers, birth dates, addresses, telephone numbers, fax numbers, email addresses, Medicare beneficiary identifiers and more.

Date reported to HHS OCR: July 28, 2023

Location: Florida

Individuals affected: 2,430,920

Tampa General Hospital determined an unauthorized third party accessed its network and removed files between May 12 and May 30, according to a breach notice. 

Information exposed by the breach may have included names, addresses, phone numbers, birth dates, Social Security numbers, health insurance information, medical record numbers, patient account numbers, dates of service and treatment information.

Date reported to HHS OCR: July 28, 2023

Location: Connecticut

Individuals affected: 398,319

UnitedHealthcare Student Resources, which provides health insurance for college students, determined an unauthorized third party could access certain systems and remove copies of personal information from its MOVEit file transfer server in late May, according to a breach notification. 

Data exposed could include names, birth dates, addresses, phone numbers, email addresses, plan identification numbers, policy information, student identification numbers, claims information and, for some people, Social Security numbers or national identification numbers.

Date reported to HHS OCR: July 27, 2023

Location: Ohio

Individuals affected: 3,180,537

CareSource, a nonprofit health plan, reported member data may have been compromised by a ransomware gang that used a vulnerability in the MOVEit file transfer system, according to a press release. 

The attack took place in late May and CareSource detected the data exposure in late June.

Compromised data may have included member identification numbers, names, addresses, dates of birth, emails, phone numbers, gender, Social Security numbers, plan name and health condition information. 

Date reported to HHS OCR: July 21, 2023

Location: Texas

Individuals Affected: 455,676 

The health system, which serves Harris Country, learned in June that a vulnerability in the MOVEit file transfer software allowed an authorized party to access its server, according to a notice from Harris Health.

Data exposed may have included names, addresses, birth dates, Social Security numbers, medical record numbers, immigration status, driver’s license number or other government-issued identification numbers, health insurance information and care information like diagnoses, medications and procedure information.

Date reported to HHS OCR: July 14, 2023

Location: Minnesota

Individuals affected: 1,866,694

The company, which works with pension plans and insurers to find people who have died and lost policyholders or beneficiaries, uses the MOVEit file transfer software, which experienced a cyberattack in late May, according to a breach notification. 

Date reported to HHS OCR: July 3, 2023

Location: Idaho

Individuals affected: 441,903

The physician-owned hospital determined an unauthorized party had accessed some of its systems between April and May and accessed or removed some files, according to a breach notification. 

Information exposed could include names, contact information, demographic information, birth dates, medical record numbers, patient account numbers, Social Security numbers, driver’s license numbers, diagnosis and treatment information, prescription information, provider names, dates and facilities where services were provided and health insurance information. 

Date reported to HHS OCR: June 21, 2023

Location: Tennessee

Individuals affected: 559,000

MMC found it was the vicim of a “sophisticated criminal cyberattack” at the end of April that involved a series of attacks on its network and IT system, according to a breach notification. 

Data exposed may have included names, birth dates, addresses, phone numbers, copies of driver’s licenses, full or partial Social Security numbers, dependent information, dates of service, medical and diagnostic information, test results, procedure notes, prescription information, medical record numbers and insurance information.

Date reported to HHS OCR: June 8, 2023

Location: Tennessee

Individuals affected: 489,830

The revenue cycle management company learned in February that Fortra, which provides file transfer software for Intellihartx, was subject to a breach, and began an investigation that was completed in May, according to an incident report. 

Information that could have been exposed includes names, addresses, medical billing and insurance information, medical details like diagnoses and medications and demographic information such as birth dates and Social Security numbers.

Date reported to HHS OCR: June 5, 2023

Location: New York

Individuals affected: 2,470,000

Enzo identified a ransomware attack on its network in April, according to a breach notice. 

Files accessed by a third party could have included data on patient names, dates of service, clinical test information and, in some instances, Social Security numbers. 

Date reported to HHS OCR: May 26, 2023

Location: Georgia

Individuals affected: 8,861,076

Dental benefits provider MCNA reported a “criminal” breached data stored on its computer systems in late February and early March, according to a breach notification. 

Information exposed in the breach could have included names, addresses, birth dates, phone numbers, emails, Social Security numbers, driver’s license or other government ID numbers and health insurance information.

Date reported on HHS OCR: May 24, 2023

Location: Massachusetts

Individuals affected: 2,624,191*

Insurer Harvard Pilgrim discovered a “cybersecurity ransomware incident” that affected systems for its commerical and Medicare Advantage Stride plans in mid-April, according to a breach notice. 

Data exposed could have included names, addresses, phone numbers, birth dates, health insurance account information, Social Security numbers, provider taxpayer identification numbers and clinical information like medical history, diagnoses and treatment.

*Updated Jan. 3, 2024

Date reported to HHS OCR: May 12, 2023

Location: Michigan

Individuals affected: 1,925,397

The dental care provider determined an unauthorized party had accessed its systems between Feb. 17 and Feb. 22, according to a breach notification. 

Data exposed could include patient names, birth dates, contact information, mailing addresses, Social Security numbers, driver’s license numbers, financial information, medical information and health insurance details. 

Date reported to HHS OCR: May 12, 2023

Location: Kentucky

Individuals affected: 5,815,591

Pharmacy services company PharMerica determined an unknown third party accessed its computer sytems in mid-March, according to a breach notification. 

Data exposed could have included names, birth dates, Social Security numbers, medication lists and health insurance information.

Date reported to HHS OCR: April 22, 2023

Location: Alabama

Individuals affected: 748,678

Rehabilitation provider Upstream discovered in January and February that certain files stored within employee email accounts may have been accessed by an unauthorized party.

Personal information affected could have included names, birth dates, contact information, demographic information, medical information, health insurance information and Social Security numbers. 

Date reported to HHS OCR: April 13, 2023

Location: Florida

Individuals affected: 3,037,303

NationsBenefits, a supplemental benefits provider for health plans and managed care organizations, first learned of a breach in early February, which was related to a vulnerability in Fortra’s GoAnywhere file transfer software, according to a notice. 

Date reported to HHS OCR: April 7, 2023

Location: California

Individuals affected: 473,467*

Pediatric behavioral health startup Brightline learned about a security vulnerability in vendor Fortra’s GoAnywhere file transfer service in early February, according to a breach notification. The provider later determined that an unauthorized party had acquired files that contained protected health information.

Data exposed may have included individuals’ names, addresses, birth dates, member identification numbers, date of health plan coverage and employer names.

*Brightline also reported separate breaches on the same date affecting 7,672 individuals, 4,044 individuals, 31,440 individuals, 7,411 individuals, 21,830 individuals and 199,753 individuals.

Date reported to HHS OCR: March 16, 2023

Location: Tennessee

Individuals affected: 962,884

CHSPSC, a professional services firm that works with for-profit hospital operator Community Health Systems, learned in early Feburary that its patients could have been affected by a breach at Fortra. Fortra contracts with CHSPSC to provide the GoAnywhere file transfer software.

Personal information exposed may have included names, addresses, medical billing and insurance information and more.

Date reported to HHS OCR: March 10, 2023

Location: Massachusetts

Individuals affected: 997,097

In late January, Zoll, a medical technology company, noticed unusual activity on its internal network, according to a breach notice. 

Information disclosed could have included names, addresses, birth dates, Social Security numbers and whether a Zoll product had been used. 

Date reported to HHS OCR: March 1, 2023

Location: Delaware

Individuals affected: 3,179,835

Digital mental healthcare provider Cerebral said it had been using pixel tracking technologies — like those made by Meta or Google that monitor user behavior on websites — on its platforms since 2019. In January, the company determined it may have disclosed protected health information to third parties, according to a breach notice. 

The information disclosed depends on what actions users took on Cerebral platforms, and could have included names, phone numbers, email addresses, birth dates, details from an online mental health assessment, subscription plan details, appointment dates and treatment information. 

Date reported to HHS OCR: Feb. 10, 2023

Location: New Jersey

Individuals affected: 617,901

In late December 2022, CentraState detected “ununsual activity” on its computer systems. An investigation determined an unauthorized user obtained a copy of an archived database that included patient information, according to a notice about a security incident. 

Information exposed could have included names, addresses, birth dates, Social Security numbers, health insurance information, medical record numbers, patient account numbers and details related to care received at CentraState.  

Date reported to HHS OCR: Feb. 10, 2023

Location: Florida

Individuals affected: 4,212,823

Revenue cycle management company Reventics discovered an intruder had encrypted and possibly accessed data on its servers in December 2022, according to a breach notification. 

Data exposed could include names, addresses, birth dates, medical record numbers, patient account numbers, driver’s license or other government ID numbers, healthcare provider information, health plan information and clinical data. 

Date reported to HHS OCR: Feb. 3, 2023

Location: Alabama

Individuals affected: 441,640

Cardiovascular Associates discovered a breach in early December 2022, and determined that an unauthorized third party was able to access certain systems that contained personal information and remove data, according to a breach notification. 

Data exposed during the breach could have included names, birth dates, addresses, Social Security numbers, health insurance details and more.

Date reported to HHS OCR: Feb. 1, 2023

Location: California

Individuals affected: 3,388,856

Regal Medical Group, Lakeside Medical Organization, ADOC Acquisition and Greater Covina Medical Group discovered they had been targeted by a ransomware attack in early December 2022, after employes reported difficulty accessing some servers, the group reported in a data breach notice. 

Personal information exposed by the breach could include names, Social Security numbers (for some affected individuals), addresses, birth dates, diagnoses and treatments, lab test results, prescription data, radiology reports, Medicare ID numbers, health plan member numbers and phone numbers.