CareTree

Disclosed Nov 15, 202315,846 affectedConfirmed

CareTree, the business associate (BA), reported that it experienced a ransomware incident that affected the protected health information (PHI) of 15,846 individuals. The breached PHI included names, addresses, dates of birth, drivers’ license and Social Security numbers, diagnoses, conditions, lab results, medications, and financial and other medical information. The BA notified HHS, affected individuals, the media, and posted substitute notice on its website. In its mitigation efforts, the BA implemented additional administrative and technical safeguards to better protect sensitive data. OCR also provided technical assistance.

What is known

People affected	15,846 (as reported to HHS)
Disclosed	Nov 15, 2023
Happened	Jul 21, 2023
Attack	Hacking
Data exposed	NamesHealth
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: CareTree

Official noticeago.vermont.gov

Vermont Attorney General: 2023-12-27 CareTree Data Breach Notice to Consumers

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): CareTree (Business Associate, IL)

Notices filed

TotalNov 15, 2023

HHS archive15,846 people

Residents of CADec 11, 2023

California AGCount not stated

Residents of VTDec 27, 2023

Vermont AGCount not stated

Residents of CAFeb 14, 2024

California AGCount not stated

History of this record

sector2026-09-25

other to healthby backfillSource

attack2026-09-25

unknown to hackingby backfillSource

data_types2026-09-25

[] to ["names","health"]by backfillSource

records_basis2026-09-25

empty to hhsby backfillSource

records2026-09-25

empty to 15846by backfillSource

disclosed2026-09-25

2023-12-11 to 2023-11-15by backfillSource

summary2026-09-25

empty to CareTree, the business associate (BA), reported that it experienced a ransomware incident that affected the protected health information (PHI) of 15,846 individuals. The breached PHI included names, addresses, dates of birth, drivers’ licenby backfillSource

source2026-09-25

empty to https://ago.vermont.gov/document/2023-12-27-caretree-data-breach-notice-consumersby backfillSource

disclosed2026-09-25

2024-02-14 to 2023-12-11by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about CareTree