Banner Health
Disclosed Aug 3, 201610 years ago3,623,140 affectedSettled
Hackers breach Banner Health systems, exposing data of millions of patients
A threat actor breached the Phoenix nonprofit health system in 2016. Banner reported 3.62 million individuals to HHS; HHS later cited 2.81 million consumers when Banner paid $1.25 million to settle HIPAA Security Rule violations.
What is known
| People affected | 3,623,140 (as reported by the organization) |
|---|---|
| Disclosed | Aug 3, 2016 |
| Discovered | Jul 13, 2016 |
| Happened | Jun 17, 2016 |
| Attack | Hacking |
| Data exposed | Health, Other, Names, Social Security numbers |
| Sector | Healthcare · US |
| Status | Settled |
| Lawsuit or fine | $1.25M HHS OCR HIPAA settlement (2023) (about $1.3M) |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Banner Healthoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Banner Healthatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Banner Healthjustice.oregon.gov · Official notice | Official notice |
| HHS Office for Civil Rights breach portal (archive): Breaches Affecting 500 or More Individualsocrportal.hhs.gov · Regulator | Regulator |
| HHS Office for Civil Rights Settles HIPAA Investigation with Arizona Hospital System Following Cybersecurity Hackingweb.archive.org · Regulator | Regulator |
| Indiana Attorney General 2016 data breach report: Banner Healthin.gov · Official notice | Official notice |
| Maine Attorney General breach notice archive: Banner Healthmaine.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Aug 3, 2016 | |
| Washington AGresidents of WA | Aug 3, 2016 | 7,916 |
| Oregon DOJresidents of OR | Aug 3, 2016 | 3,623,140 |
| Researchtotal | Aug 3, 2016 | 3,620,000 |
| Indiana AGresidents of IN | Aug 3, 2016 | 2,082 |
| Maine AGresidents of ME | Aug 3, 2016 | 353 |
| HHS archivetotal | Aug 3, 2016 | 3,620,000 |
| Maine AGresidents of ME | Dec 19, 2016 | 1 |
Other breaches at Banner Health
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Mar 5, 2014Mar 5, 201412 years ago | Mar 5, 201412 years ago | Not stated | Healthcare | Confirmed | 55K |
History of this record
- 2026-09-25 · data_types: ["health","other","names"] to ["health","other","names","ssn"] · backfill source
- 2026-09-25 · data_types: ["health","other"] to ["health","other","names"] · backfill source
- 2026-09-25 · records: 3620000 to 3623140 · backfill source
- 2026-09-25 · status: confirmed to settled · seed source
- 2026-09-25 · fine_usd: empty to 1250000 · seed source
- 2026-09-25 · lawsuit: empty to $1.25M HHS OCR HIPAA settlement (2023) · seed source
- 2026-09-25 · data_types: [] to ["health","other"] · seed source
- 2026-09-25 · records_basis: empty to organization · seed source
- 2026-09-25 · records: empty to 3620000 · seed source
- 2026-09-25 · summary: empty to A threat actor breached the Phoenix nonprofit health system in 2016. Banner reported 3.62 million individuals to HHS; HHS later cited 2.81 million consumers when Banner paid $1.25 million to settle HIPAA Security Rule violations. · seed source
- 2026-09-25 · title: empty to Hackers breach Banner Health systems, exposing data of millions of patients · seed source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2016-07-13 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.