Every public data breach

Disclosed this week44On record26,355

44 disclosed this week · 26,355 on record

Apria Healthcare

Disclosed May 16, 20221,869,598 affectedConfirmed

Official notice

The covered entity (CE), Apria Healthcare, reported that an employee was the subject of an email phishing scheme that affected the protected health information (PHI) of 1,868,831 individuals. The PHI involved included names, dates of birth, addresses, drivers’ license and social security numbers, claims and financial information, diagnoses, lab results, medications, and other treatment information. The CE implemented additional technical and security safeguards in response to the breach. OCR provided the CE with technical assistance.

What is known

People affected1,869,598 (as reported by the organization)
DisclosedMay 16, 2022
DiscoveredSep 1, 2021
HappenedApr 5, 2019
AttackHacking
Data exposedNamesHealth
SectorHealthcare · US
StatusConfirmed

Sources

Official noticeoag.ca.gov
California Attorney General breach notice: Apria Healthcare
Official noticeatg.wa.gov
Washington Attorney General breach notice: Apria Healthcare
Official noticejustice.oregon.gov
Oregon DOJ breach notice: Apria Healthcare
Official noticein.gov
Indiana Attorney General 2023 data breach report: Apria Healthcare
Official noticeocrportal.hhs.gov
HHS OCR breach report (archive, resolved): Apria Healthcare (Healthcare Provider, IN)

Notices filed

TotalMay 16, 2022
HHS archive1,868,831 people
Residents of CAMay 22, 2023
California AGCount not stated
Residents of WAMay 22, 2023
Washington AG69,686 people
Residents of ORMay 22, 2023
Oregon DOJ1,869,598 people
Residents of INMay 22, 2023
Indiana AG42,021 people

Other breaches at Apria Healthcare

Insider breachInsider exposed names and health records. Reported to the HHS archive.713 affectedHealthcareUSMar 28, 2025Insider breachInsider exposed names and health records. Reported to the California AG.1,987 affectedHealthcareUSOct 4, 2016Lost or stolen device breachLost or stolen device exposed names and health records. Reported to the California AG.66K affectedHealthcareUSAug 15, 2012
History of this record
data_types2026-09-25
[] to ["names","health"]by backfillSource
disclosed2026-09-25
2023-05-22 to 2022-05-16by backfillSource
summary2026-09-25
empty to The covered entity (CE), Apria Healthcare, reported that an employee was the subject of an email phishing scheme that affected the protected health information (PHI) of 1,868,831 individuals. The PHI involved included names, dates of birth,by backfillSource
records_basis2026-09-25
empty to organizationby backfillSource
records2026-09-25
empty to 1869598by backfillSource
attack2026-09-25
unknown to hackingby backfillSource
discovered2026-09-25
empty to 2021-09-01by backfillSource
Added2026-09-25
First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Apria Healthcare