CareTree
Disclosed Nov 15, 20232 years ago15,846 affectedConfirmed
CareTree, the business associate (BA), reported that it experienced a ransomware incident that affected the protected health information (PHI) of 15,846 individuals. The breached PHI included names, addresses, dates of birth, drivers’ license and Social Security numbers, diagnoses, conditions, lab results, medications, and financial and other medical information. The BA notified HHS, affected individuals, the media, and posted substitute notice on its website. In its mitigation efforts, the BA implemented additional administrative and technical safeguards to better protect sensitive data. OCR also provided technical assistance.
What is known
| People affected | 15,846 (as reported to HHS) |
|---|---|
| Disclosed | Nov 15, 2023 |
| Happened | Jul 21, 2023 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: CareTreeoag.ca.gov · Official notice | Official notice |
| Vermont Attorney General: 2023-12-27 CareTree Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): CareTree (Business Associate, IL)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Nov 15, 2023 | 15,846 |
| California AGresidents of CA | Dec 11, 2023 | |
| Vermont AGresidents of VT | Dec 27, 2023 | |
| California AGresidents of CA | Feb 14, 2024 |
History of this record
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 15846 · backfill source
- 2026-09-25 · disclosed: 2023-12-11 to 2023-11-15 · backfill source
- 2026-09-25 · summary: empty to CareTree, the business associate (BA), reported that it experienced a ransomware incident that affected the protected health information (PHI) of 15,846 individuals. The breached PHI included names, addresses, dates of birth, drivers’ licen · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2023-12-27-caretree-data-breach-notice-consumers · backfill source
- 2026-09-25 · disclosed: 2024-02-14 to 2023-12-11 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.