A&A Services
Disclosed May 24, 20242 years ago2,812,336 affectedConfirmed
What is known
| People affected | 2,812,336 (as reported to HHS) |
|---|---|
| Disclosed | May 24, 2024 |
| Discovered | Apr 30, 2024 |
| Happened | Oct 8, 2023 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: A&A Servicesoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: A&A Servicesatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: A&A Servicesjustice.oregon.gov · Official notice | Official notice |
| Vermont Attorney General: 2024-05-24 A&A Services dba Sav-Rx Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Vermont Attorney General: 2024-05-24 A&A Services dba Sav-Rx Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): A&A Services (Business Associate, NE)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | May 24, 2024 | |
| Washington AGresidents of WA | May 24, 2024 | 69,051 |
| Oregon DOJresidents of OR | May 24, 2024 | 2,812,336 |
| Vermont AGresidents of VT | May 24, 2024 | |
| Vermont AGresidents of VT | May 24, 2024 | |
| HHS archivetotal | May 24, 2024 | 2,812,336 |
History of this record
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 2812336 · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2024-05-24-aa-services-dba-sav-rx-data-breach-notice-consumers-0 · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2024-05-24-aa-services-dba-sav-rx-data-breach-notice-consumers · backfill source
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2024-04-30 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.