Assurance Health System
Disclosed Oct 28, 20223 years ago3,565 affectedConfirmed
The covered entity (CE), Assurance Health System reported that several employees were the subjects of an email phishing attack that affected the protected health information (PHI) of 3,565 individuals. The PHI involved included names, addresses, dates of birth, drivers’ license and social security numbers, medical record numbers, diagnoses, medications, and other treatment and health insurance information. The CE notified HHS, the affected individuals, and the media. In its mitigation efforts, the CE implemented multifactor authentication as well as other measures to strengthen the security of its network.
What is known
| People affected | 3,565 (as reported to HHS) |
|---|---|
| Disclosed | Oct 28, 2022 |
| Happened | Jun 10, 2021 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Indiana Attorney General 2022 data breach report: Assurance Health Systemin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Assurance Health System (Healthcare Provider, IN)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Oct 28, 2022 | 237 |
| HHS archivetotal | Oct 28, 2022 | 3,565 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 781 to 3565 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Assurance Health System reported that several employees were the subjects of an email phishing attack that affected the protected health information (PHI) of 3,565 individuals. The PHI involved included names, addre · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.