Cancer Treatment Centers of America at Southeastern Regional Medical Center
Disclosed May 10, 20197 years ago16,819 affectedConfirmed
The covered entity (CE), Cancer Treatment Centers of America at Southeastern Regional Medical Center, reported that several employees were the victims of an email phishing scheme that affected the electronic protected health information (ePHI) of 3,290 individuals. The ePHI involved included names, Social Security numbers, telephone numbers, addresses, dates of birth, financial information, health insurance information and clinical information. The CE notified HHS, affected individuals, the media, and posted substitute notice on its website. In response to the breach, the CE implemented additional technical and security safeguards and retrained its employees on recognizing and responding to fraudulent email communications. OCR obtained assurances that the CE implemented the corrective actions noted.
What is known
| People affected | 16,819 (as reported to HHS) |
|---|---|
| Disclosed | May 10, 2019 |
| Discovered | Jul 29, 2019 |
| Happened | Jul 22, 2019 |
| Attack | Hacking |
| Data exposed | Names, Government IDs, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Oregon DOJ breach notice: Cancer Treatment Centers of America at Southeastern Regional Medical Centerjustice.oregon.gov · Official notice | Official notice |
| Maine Attorney General breach notice archive: Cancer Treatment Centers of America at Southeastern Regional Medical Centermaine.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Cancer Treatment Centers of America at Southeastern Regional Medical Center (Healthcare Provider, GA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | May 10, 2019 | 16,819 |
| Maine AGresidents of ME | May 15, 2019 | 16,819 |
| HHS archivetotal | Jul 12, 2019 | 4,559 |
| Oregon DOJresidents of OR | Jul 15, 2019 | 4,559 |
| Oregon DOJresidents of OR | Sep 27, 2019 | 3,290 |
| HHS archivetotal | Sep 27, 2019 | 3,290 |
History of this record
- 2026-09-25 · records: 4559 to 16819 · backfill source
- 2026-09-25 · disclosed: 2019-05-15 to 2019-05-10 · backfill source
- 2026-09-25 · records: 3290 to 4559 · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: ["names","government-id"] to ["names","government-id","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 3290 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Cancer Treatment Centers of America at Southeastern Regional Medical Center, reported that several employees were the victims of an email phishing scheme that affected the electronic protected health information (eP · backfill source
- 2026-09-25 · data_types: [] to ["names","government-id"] · backfill source
- 2026-09-25 · disclosed: 2019-07-15 to 2019-05-15 · backfill source
- 2026-09-25 · disclosed: 2019-09-27 to 2019-07-15 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Oregon DOJ), confirmed by Oregon DOJ. Record counts are as reported. Not legal advice.
Everything about Cancer Treatment Centers of America at Southeastern Regional Medical Center