Calibre CPA Group
Disclosed Aug 26, 20197 years ago62,114 affectedConfirmed
Calibre CPA Group, a business associate (BA), reported that several employees were the victims of an email phishing scheme that affected the protected health information (PHI) of 7,937 individuals. The PHI involved included names and Social Security numbers. In its mitigation efforts, the BA implemented numerous administrative, technical, and security safeguards to better protect its sensitive data. Calibre also retrained its staff on the proper methods of identifying fraudulent email communications. During the investigation, OCR provided the BA with technical assistance on the provisions of the Breach Notification Rule. OCR obtained assurances that the BA implemented the corrective actions noted.
What is known
| People affected | 62,114 (as reported by the organization) |
|---|---|
| Disclosed | Aug 26, 2019 |
| Discovered | Apr 16, 2019 |
| Happened | Mar 11, 2019 |
| Attack | Hacking |
| Data exposed | Names, Social Security numbers, Payment cards, Financial, Health |
| Sector | Finance · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Calibre CPA Groupoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Calibre CPA Groupatg.wa.gov · Official notice | Official notice |
| Indiana Attorney General 2019 data breach report: Calibre CPA Groupin.gov · Official notice | Official notice |
| Maine Attorney General breach notice archive: Calibre CPA Groupmaine.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Calibre CPA Group (Business Associate, MD)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Aug 26, 2019 | 13 |
| Maine AGresidents of ME | Aug 26, 2019 | 32 |
| California AGresidents of CA | Sep 9, 2019 | |
| HHS archivetotal | Sep 27, 2019 | 912 |
| Washington AGresidents of WA | Oct 10, 2019 | 983 |
History of this record
- 2026-09-25 · data_types: ["names","ssn","payment-card","financial"] to ["names","ssn","payment-card","financial","health"] · backfill source
- 2026-09-25 · summary: empty to Calibre CPA Group, a business associate (BA), reported that several employees were the victims of an email phishing scheme that affected the protected health information (PHI) of 7,937 individuals. The PHI involved included names and Social · backfill source
- 2026-09-25 · data_types: [] to ["names","ssn","payment-card","financial"] · backfill source
- 2026-09-25 · records: 1801 to 62114 · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 1801 · backfill source
- 2026-09-25 · disclosed: 2019-09-09 to 2019-08-26 · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2019-04-16 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.