Banner Health

Disclosed Aug 3, 20163,623,140 affectedSettled

Hackers breach Banner Health systems, exposing data of millions of patients

A threat actor breached the Phoenix nonprofit health system in 2016. Banner reported 3.62 million individuals to HHS; HHS later cited 2.81 million consumers when Banner paid $1.25 million to settle HIPAA Security Rule violations.

What is known

People affected	3,623,140 (as reported by the organization)
Disclosed	Aug 3, 2016
Discovered	Jul 13, 2016
Happened	Jun 17, 2016
Attack	Hacking
Data exposed	HealthOtherNamesSocial Security numbers
Sector	Healthcare · US
Status	Settled
Lawsuit or fine	$1.25M HHS OCR HIPAA settlement (2023) (about $1.3M)

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Banner Health

Official noticeatg.wa.gov

Washington Attorney General breach notice: Banner Health

Official noticejustice.oregon.gov

Oregon DOJ breach notice: Banner Health

Regulatorocrportal.hhs.gov

HHS Office for Civil Rights breach portal (archive): Breaches Affecting 500 or More Individuals

Regulatorweb.archive.org

HHS Office for Civil Rights Settles HIPAA Investigation with Arizona Hospital System Following Cybersecurity Hacking

Official noticein.gov

Indiana Attorney General 2016 data breach report: Banner Health

Official noticemaine.gov

Maine Attorney General breach notice archive: Banner Health

Notices filed

Residents of CAAug 3, 2016

California AGCount not stated

Residents of WAAug 3, 2016

Washington AG7,916 people

Residents of ORAug 3, 2016

Oregon DOJ3,623,140 people

TotalAug 3, 2016

Research3,620,000 people

Residents of INAug 3, 2016

Indiana AG2,082 people

Residents of MEAug 3, 2016

Maine AG353 people

TotalAug 3, 2016

HHS archive3,620,000 people

Residents of MEDec 19, 2016

Maine AG1 person

Other breaches at Banner Health

Breach, details not statedExposed names and health records. Reported to the HHS archive.55K affectedHealthcareUSMar 5, 2014

History of this record

data_types2026-09-25

["health","other","names"] to ["health","other","names","ssn"]by backfillSource

data_types2026-09-25

["health","other"] to ["health","other","names"]by backfillSource

records2026-09-25

3620000 to 3623140by backfillSource

status2026-09-25

confirmed to settledby seedSource

fine_usd2026-09-25

empty to 1250000by seedSource

lawsuit2026-09-25

empty to $1.25M HHS OCR HIPAA settlement (2023)by seedSource

data_types2026-09-25

[] to ["health","other"]by seedSource

records_basis2026-09-25

empty to organizationby seedSource

records2026-09-25

empty to 3620000by seedSource

summary2026-09-25

empty to A threat actor breached the Phoenix nonprofit health system in 2016. Banner reported 3.62 million individuals to HHS; HHS later cited 2.81 million consumers when Banner paid $1.25 million to settle HIPAA Security Rule violations.by seedSource

title2026-09-25

empty to Hackers breach Banner Health systems, exposing data of millions of patientsby seedSource

attack2026-09-25

unknown to hackingby backfillSource

discovered2026-09-25

empty to 2016-07-13by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Banner Health