Advarra
Disclosed Feb 2, 20242 years ago596 affectedConfirmed
The business associate (BA), Advarra, reported that it experienced a hacking attack of an employee’s email account which compromised the protected health information (PHI) of 596 individuals. The PHI involved included names, dates of birth, addresses, Social Security numbers, financial information, and treatment information. The BA notified HHS, the affected individuals, the media, and provided substitute notice. In response to the breach, the BA provided complimentary credit monitoring and implemented additional administrative, technical, and security safeguards. Staff were retrained to better protect sensitive data.
What is known
| People affected | 596 (as reported to HHS) |
|---|---|
| Disclosed | Feb 2, 2024 |
| Discovered | Oct 30, 2023 |
| Happened | Oct 25, 2023 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Washington Attorney General breach notice: Advarraatg.wa.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Advarra (Business Associate, MD)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Washington AGresidents of WA | Feb 2, 2024 | 1,066 |
| HHS archivetotal | Apr 19, 2024 | 596 |
History of this record
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 596 · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), Advarra, reported that it experienced a hacking attack of an employee’s email account which compromised the protected health information (PHI) of 596 individuals. The PHI involved included names, dates of birth, · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Washington AG), confirmed by Washington AG. Record counts are as reported. Not legal advice.