AFTRA Retirement Fund
Disclosed Feb 25, 20206 years ago494,069 affectedConfirmed
The business associate (BA), AFTRA Retirement Fund, reported that it was the victim of a cyber-attack that affected the electronic protected health information (ePHI) of 57,900 individuals. The ePHI involved included names, dates of birth, addresses, Social Security numbers, and claims and financial information. The BA notified HHS, affected individuals, the media, and provided substitute notice. Following the breach, the BA implemented additional technical safeguards to better protect its ePHI. OCR obtained assurances that the BA implemented the corrective actions noted.
What is known
| People affected | 494,069 (as reported by the organization) |
|---|---|
| Disclosed | Feb 25, 2020 |
| Discovered | Oct 28, 2019 |
| Happened | Oct 24, 2019 |
| Attack | Hacking |
| Data exposed | Names, Social Security numbers, Health |
| Sector | Finance · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: AFTRA Retirement Fundoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: AFTRA Retirement Fundatg.wa.gov · Official notice | Official notice |
| Notice letter filed with the Delaware DOJ: AFTRA Retirement Fundattorneygeneral.delaware.gov · Official notice | Official notice |
| Oregon DOJ breach notice: AFTRA Retirement Fundjustice.oregon.gov · Official notice | Official notice |
| Indiana Attorney General 2020 data breach report: AFTRA Retirement Fundin.gov · Official notice | Official notice |
| Maine Attorney General breach notice archive: AFTRA Retirement Fundmaine.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): AFTRA Retirement Fund (Business Associate, NY)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Feb 25, 2020 | |
| Washington AGresidents of WA | Feb 25, 2020 | 8,803 |
| Oregon DOJresidents of OR | Feb 25, 2020 | 57,207 |
| Indiana AGresidents of IN | Feb 25, 2020 | 2,036 |
| Maine AGresidents of ME | Feb 25, 2020 | 67 |
| HHS archivetotal | Feb 25, 2020 | 57,900 |
| Delaware DOJresidents of DE | Dec 16, 2020 | 531 |
History of this record
- 2026-09-25 · data_types: ["names","ssn"] to ["names","ssn","health"] · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), AFTRA Retirement Fund, reported that it was the victim of a cyber-attack that affected the electronic protected health information (ePHI) of 57,900 individuals. The ePHI involved included names, dates of birth, · backfill source
- 2026-09-25 · data_types: ["names"] to ["names","ssn"] · backfill source
- 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-2020.pdf · backfill source
- 2026-09-25 · data_types: [] to ["names"] · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 494069 · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2019-10-28 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.