Cerebral
Disclosed Mar 1, 20233 years ago3,179,835 affectedConfirmed
Cerebral, the business associate (BA) reported that it may have impermissibly disclosed the protected health information (PHI) of 3,179,835 individuals through the use of Internet tracking technologies. The PHI involved include names, addresses birthdates, diagnoses, and other treatment information. The BA notified HHS, affected individuals, the media, and provided substitute notice on its website. In response to the breach, Cerebral provided complimentary credit monitoring services and revised its policies and procedures, retrained workforce members, and implemented additional administrative and technical safeguards.
What is known
| People affected | 3,179,835 (as reported to HHS) |
|---|---|
| Disclosed | Mar 1, 2023 |
| Discovered | Jan 3, 2023 |
| Happened | Oct 12, 2019 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Cerebraloag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Cerebralatg.wa.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Cerebral (Business Associate, DE)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Mar 1, 2023 | 3,179,835 |
| Washington AGresidents of WA | Mar 3, 2023 | 86,669 |
| California AGresidents of CA | Mar 6, 2023 |
History of this record
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 3179835 · backfill source
- 2026-09-25 · disclosed: 2023-03-03 to 2023-03-01 · backfill source
- 2026-09-25 · summary: empty to Cerebral, the business associate (BA) reported that it may have impermissibly disclosed the protected health information (PHI) of 3,179,835 individuals through the use of Internet tracking technologies. The PHI involved include names, addre · backfill source
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · disclosed: 2023-03-06 to 2023-03-03 · backfill source
- 2026-09-25 · discovered: empty to 2023-01-03 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.