A New Leaf
Disclosed Dec 30, 20214 years ago17,150 affectedConfirmed
The covered entity (CE), A New Leaf, Inc., reported that it experienced a ransomware attack that compromised the protected health information (PHI) of approximately 10,438 individuals. The PHI involved included names, addresses, Social Security numbers, diagnoses, medications prescribed, and other treatment information. The CE notified HHS, affected individuals, the media, and provided substitute notice. Following OCR’s investigation, the CE retrained its workforce members and implemented additional technical safeguards to better protect its PHI.
What is known
| People affected | 17,150 (as reported by the organization) |
|---|---|
| Disclosed | Dec 30, 2021 |
| Happened | Mar 30, 2021 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Indiana Attorney General 2022 data breach report: A New Leafin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): A New Leaf (Healthcare Provider, AZ)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Dec 30, 2021 | 10 |
| HHS archivetotal | Dec 30, 2021 | 10,438 |
History of this record
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), A New Leaf, Inc., reported that it experienced a ransomware attack that compromised the protected health information (PHI) of approximately 10,438 individuals. The PHI involved included names, addresses, Social Secu · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.