Alera Group
Disclosed May 21, 20251 year ago174,378 affectedConfirmed
What is known
| People affected | 174,378 (as reported to HHS) |
|---|---|
| Disclosed | May 21, 2025 |
| Discovered | Aug 4, 2024 |
| Happened | Aug 4, 2024 |
| Attack | Ransomware |
| Data exposed | Names, Government IDs, Health, Insurance, Credentials and tokens |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Alera Groupoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Alera Groupatg.wa.gov · Official notice | Official notice |
| Notice letter filed with the Delaware DOJ: Alera Groupattorneygeneral.delaware.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Alera Groupjustice.oregon.gov · Official notice | Official notice |
| Indiana Attorney General 2025 data breach report: Alera Groupin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Alera Group (Business Associate, IL)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | May 21, 2025 | |
| Washington AGresidents of WA | May 21, 2025 | 27,901 |
| Oregon DOJresidents of OR | May 21, 2025 | 10,874 |
| Indiana AGresidents of IN | May 21, 2025 | 4,810 |
| California AGresidents of CA | Jun 13, 2025 | |
| California AGresidents of CA | Jul 29, 2025 | |
| Delaware DOJresidents of DE | Jul 29, 2025 | 3,215 |
| HHS archivetotal | Jul 29, 2025 | 174,378 |
| California AGresidents of CA | Aug 28, 2025 | |
| California AGresidents of CA | Nov 7, 2025 | |
| Oregon DOJresidents of OR | Dec 18, 2025 | 18,159 |
History of this record
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 10874 to 174378 · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 10874 · backfill source
- 2026-09-25 · data_types: [] to ["names","government-id","health","insurance","credentials"] · backfill source
- 2026-09-25 · attack: unknown to ransomware · backfill source
- 2026-09-25 · discovered: empty to 2024-08-04 · backfill source
- 2026-09-25 · disclosed: 2025-06-13 to 2025-05-21 · backfill source
- 2026-09-25 · disclosed: 2025-07-29 to 2025-06-13 · backfill source
- 2026-09-25 · occurred: empty to 2024-08-04 · backfill source
- 2026-09-25 · disclosed: 2025-08-28 to 2025-07-29 · backfill source
- 2026-09-25 · disclosed: 2025-11-07 to 2025-08-28 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.