ATI Holdings
Disclosed Mar 12, 20188 years ago45,800 affectedConfirmed
The covered entity (CE), ATI Holdings, reported that multiple employees were the victims of an email phishing attack affecting the protected health information (PHI) of 2,645 individuals. The PHI involved included names, dates of birth, Social Security numbers, addresses, drivers’ license numbers, diagnoses/conditions, medications prescribed, and other financial and treatment information. The CE notified HHS, affected individuals, the media, and provided substitute notice on its website. In response to the breach, the CE implemented additional technical safeguards and retrained its staff on email security.
What is known
| People affected | 45,800 (as reported to HHS) |
|---|---|
| Disclosed | Mar 12, 2018 |
| Happened | Jan 9, 2018 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Oregon DOJ breach notice: ATI Holdingsjustice.oregon.gov · Official notice | Official notice |
| Indiana Attorney General 2018 data breach report: ATI Holdingsin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): ATI Holdings (Business Associate, IL)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Mar 12, 2018 | 45,800 |
| Indiana AGresidents of IN | Mar 27, 2018 | 78 |
| HHS archivetotal | Apr 13, 2018 | 2,645 |
| Oregon DOJresidents of OR | Jul 5, 2018 | 45,799 |
History of this record
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 34665 to 45800 · backfill source
- 2026-09-25 · disclosed: 2018-03-27 to 2018-03-12 · backfill source
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), ATI Holdings, reported that multiple employees were the victims of an email phishing attack affecting the protected health information (PHI) of 2,645 individuals. The PHI involved included names, dates of birth, Soc · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 34665 · backfill source
- 2026-09-25 · disclosed: 2018-07-05 to 2018-03-27 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Oregon DOJ), confirmed by Oregon DOJ. Record counts are as reported. Not legal advice.