Brightline
Disclosed Apr 7, 20233 years ago199,753 affectedConfirmed
The business associate (BA), Brightline, reported that its third-party provider was the victim of a cyber-attack affecting the protected health information (PHI) of 8,432 individuals. The PHI involved included names, dates of birth, addresses, member and group identification numbers, and gender identification. The BA notified HHS, affected individuals, the media, and provided substitute notice. In response to the breach, the BA provided complimentary credit monitoring services and implemented additional security and technical safeguards. OCR provided the BA with technical assistance regarding the HIPAA Privacy, Security, and Breach Notification Rules.
What is known
| People affected | 199,753 (as reported to HHS) |
|---|---|
| Disclosed | Apr 7, 2023 |
| Discovered | Feb 4, 2023 |
| Happened | Jan 30, 2023 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Brightlineoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Brightlineatg.wa.gov · Official notice | Official notice |
| Notice letter filed with the Delaware DOJ: Brightlineattorneygeneral.delaware.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Brightlinejustice.oregon.gov · Official notice | Official notice |
| Vermont Attorney General: 2023-04-19 Brightline Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Indiana Attorney General 2023 data breach report: Brightlinein.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Brightline (Business Associate, CA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Delaware DOJresidents of DE | Apr 7, 2023 | 19 |
| Indiana AGresidents of IN | Apr 7, 2023 | 2,373 |
| HHS archivetotal | Apr 7, 2023 | 199,753 |
| Washington AGresidents of WA | Apr 10, 2023 | 26,333 |
| California AGresidents of CA | Apr 12, 2023 | |
| HHS archivetotal | Apr 13, 2023 | 49,968 |
| Vermont AGresidents of VT | Apr 19, 2023 | |
| HHS archivetotal | Apr 20, 2023 | 180,694 |
| California AGresidents of CA | Apr 21, 2023 | |
| Oregon DOJresidents of OR | May 2, 2023 | |
| California AGresidents of CA | May 10, 2023 | |
| HHS archivetotal | May 10, 2023 | 28,975 |
| California AGresidents of CA | May 12, 2023 | |
| California AGresidents of CA | May 17, 2023 | |
| HHS archivetotal | May 26, 2023 | 8,432 |
History of this record
- 2026-09-25 · records: 180694 to 199753 · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 35492 to 180694 · backfill source
- 2026-09-25 · data_types: ["names"] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), Brightline, reported that its third-party provider was the victim of a cyber-attack affecting the protected health information (PHI) of 8,432 individuals. The PHI involved included names, dates of birth, address · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 35492 · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2023-04-19-brightline-data-breach-notice-consumers · backfill source
- 2026-09-25 · data_types: [] to ["names"] · backfill source
- 2026-09-25 · disclosed: 2023-04-10 to 2023-04-07 · backfill source
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · disclosed: 2023-04-12 to 2023-04-10 · backfill source
- 2026-09-25 · discovered: empty to 2023-02-04 · backfill source
- 2026-09-25 · disclosed: 2023-04-21 to 2023-04-12 · backfill source
- 2026-09-25 · disclosed: 2023-05-10 to 2023-04-21 · backfill source
- 2026-09-25 · disclosed: 2023-05-12 to 2023-05-10 · backfill source
- 2026-09-25 · disclosed: 2023-05-17 to 2023-05-12 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.