Bergen's Promise
Disclosed Jun 7, 20224 years ago7,349 affectedConfirmed
Bergen’s Promise, the business associate (BA), reported that multiple employees were the subjects of an email phishing attack that affected the protected health information (PHI) of 7,349 individuals. The PHI involved included names, addresses, dates of birth, drivers’ license numbers, Social Security numbers, diagnoses, and financial and health insurance information. The BA notified HHS, affected individuals, the media, and provided substitute notice. In response to the breach, the BA provided free credit monitoring and identity theft protection services and implemented additional administrative and technical safeguards. OCR provided technical assistance regarding the HIPAA Rules.
What is known
| People affected | 7,349 (as reported to HHS) |
|---|---|
| Disclosed | Jun 7, 2022 |
| Happened | Jun 2, 2022 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Indiana Attorney General 2022 data breach report: Bergen's Promisein.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Bergen's Promise (Business Associate, NJ)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Jun 7, 2022 | 7,349 |
| Indiana AGresidents of IN | Nov 1, 2022 | 1 |
History of this record
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 360 to 7349 · backfill source
- 2026-09-25 · disclosed: 2022-11-01 to 2022-06-07 · backfill source
- 2026-09-25 · summary: empty to Bergen’s Promise, the business associate (BA), reported that multiple employees were the subjects of an email phishing attack that affected the protected health information (PHI) of 7,349 individuals. The PHI involved included names, addres · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.