Every public data breach

Disclosed this week44On record26,355

44 disclosed this week · 26,355 on record

AFTRA Retirement Fund

Disclosed Feb 25, 2020494,069 affectedConfirmed

Official notice

The business associate (BA), AFTRA Retirement Fund, reported that it was the victim of a cyber-attack that affected the electronic protected health information (ePHI) of 57,900 individuals. The ePHI involved included names, dates of birth, addresses, Social Security numbers, and claims and financial information. The BA notified HHS, affected individuals, the media, and provided substitute notice. Following the breach, the BA implemented additional technical safeguards to better protect its ePHI. OCR obtained assurances that the BA implemented the corrective actions noted.

What is known

People affected494,069 (as reported by the organization)
DisclosedFeb 25, 2020
DiscoveredOct 28, 2019
HappenedOct 24, 2019
AttackHacking
Data exposedNamesSocial Security numbersHealth
SectorFinance · US
StatusConfirmed

Sources

Official noticeoag.ca.gov
California Attorney General breach notice: AFTRA Retirement Fund
Official noticeatg.wa.gov
Washington Attorney General breach notice: AFTRA Retirement Fund
Official noticeattorneygeneral.delaware.gov
Notice letter filed with the Delaware DOJ: AFTRA Retirement Fund
Official noticejustice.oregon.gov
Oregon DOJ breach notice: AFTRA Retirement Fund
Official noticein.gov
Indiana Attorney General 2020 data breach report: AFTRA Retirement Fund
Official noticemaine.gov
Maine Attorney General breach notice archive: AFTRA Retirement Fund
Official noticeocrportal.hhs.gov
HHS OCR breach report (archive, resolved): AFTRA Retirement Fund (Business Associate, NY)

Notices filed

Residents of CAFeb 25, 2020
California AGCount not stated
Residents of WAFeb 25, 2020
Washington AG8,803 people
Residents of ORFeb 25, 2020
Oregon DOJ57,207 people
Residents of INFeb 25, 2020
Indiana AG2,036 people
Residents of MEFeb 25, 2020
Maine AG67 people
TotalFeb 25, 2020
HHS archive57,900 people
Residents of DEDec 16, 2020
Delaware DOJ531 people
History of this record
data_types2026-09-25
["names","ssn"] to ["names","ssn","health"]by backfillSource
summary2026-09-25
empty to The business associate (BA), AFTRA Retirement Fund, reported that it was the victim of a cyber-attack that affected the electronic protected health information (ePHI) of 57,900 individuals. The ePHI involved included names, dates of birth, by backfillSource
data_types2026-09-25
["names"] to ["names","ssn"]by backfillSource
source2026-09-25
empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-2020.pdfby backfillSource
data_types2026-09-25
[] to ["names"]by backfillSource
records_basis2026-09-25
empty to organizationby backfillSource
records2026-09-25
empty to 494069by backfillSource
attack2026-09-25
unknown to hackingby backfillSource
discovered2026-09-25
empty to 2019-10-28by backfillSource
Added2026-09-25
First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about AFTRA Retirement Fund