CareATC
Disclosed Aug 27, 20215 years ago98,774 affectedConfirmed
The covered entity (CE), CareATC, reported that several employees were subject to an email phishing attack that compromised the protected health information (PHI) of 98,774 individuals. The PHI involved included names, addresses, dates of birth, drivers’ license and Social Security numbers, claims information, medications, diagnoses, and lab results. The CE notified HHS, affected individuals, the media, and provided substitute notice. In response to the breach, the CE provided complimentary credit monitoring services and implemented additional administrative, technical, and security safeguards to better protect PHI. Workforce members were also retrained.
What is known
| People affected | 98,774 (as reported by the organization) |
|---|---|
| Disclosed | Aug 27, 2021 |
| Discovered | Jun 29, 2021 |
| Happened | Jun 18, 2021 |
| Attack | Phishing |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Washington Attorney General breach notice: CareATCatg.wa.gov · Official notice | Official notice |
| Indiana Attorney General 2021 data breach report: CareATCin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): CareATC (Healthcare Provider, OK)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Washington AGresidents of WA | Aug 27, 2021 | 600 |
| Indiana AGresidents of IN | Aug 27, 2021 | 1 |
| HHS archivetotal | Aug 27, 2021 | 98,774 |
History of this record
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), CareATC, reported that several employees were subject to an email phishing attack that compromised the protected health information (PHI) of 98,774 individuals. The PHI involved included names, addresses, dates of b · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 98774 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Washington AG), confirmed by Washington AG. Record counts are as reported. Not legal advice.