ALN Medical Management
Disclosed May 23, 20242 years ago1,323,720 affectedConfirmed
The business associate (BA), ALN Medical Management, reported that it experienced a ransomware attack that compromised the protected health information (PHI) of 1,323,720 individuals. The PHI involved included demographic, financial, and clinical information. The BA notified HHS, affected individuals, the media, and provided substitute notice. In its mitigation efforts, the BA implemented new technical safeguards and revised its policies and procedures.
What is known
| People affected | 1,323,720 (as reported to HHS) |
|---|---|
| Disclosed | May 23, 2024 |
| Discovered | Mar 24, 2024 |
| Happened | Mar 18, 2024 |
| Attack | Ransomware |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: ALN Medical Managementoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: ALN Medical Managementatg.wa.gov · Official notice | Official notice |
| Vermont Attorney General: 2025-03-21 ALN Medical Management Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): ALN Medical Management (Business Associate, NE)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | May 23, 2024 | 1,323,720 |
| California AGresidents of CA | Mar 21, 2025 | |
| Vermont AGresidents of VT | Mar 21, 2025 | |
| California AGresidents of CA | May 23, 2025 | |
| Washington AGresidents of WA | May 23, 2025 | 7,587 |
History of this record
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 1323720 · backfill source
- 2026-09-25 · disclosed: 2025-03-21 to 2024-05-23 · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), ALN Medical Management, reported that it experienced a ransomware attack that compromised the protected health information (PHI) of 1,323,720 individuals. The PHI involved included demographic, financial, and cl · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2025-03-21-aln-medical-management-data-breach-notice-consumers · backfill source
- 2026-09-25 · attack: unknown to ransomware · backfill source
- 2026-09-25 · discovered: empty to 2024-03-24 · backfill source
- 2026-09-25 · disclosed: 2025-05-23 to 2025-03-21 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.