CF Medical
Disclosed Sep 9, 20242 years ago626,396 affectedConfirmed
CF Medical reported that it experienced a hacking incident that compromised the protected health information of 242,200 individuals. Upon starting the investigation it was determined that CF Medical was not a covered entity; therefore, the case was closed.
What is known
| People affected | 626,396 (as reported by the organization) |
|---|---|
| Disclosed | Sep 9, 2024 |
| Discovered | Feb 26, 2024 |
| Happened | Feb 14, 2024 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Washington Attorney General breach notice: CF Medicalatg.wa.gov · Official notice | Official notice |
| Delaware DOJ breach notice: CF Medicalattorneygeneral.delaware.gov · Official notice | Official notice |
| Indiana Attorney General 2024 data breach report: CF Medicalin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): CF Medical (Business Associate, GA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Sep 9, 2024 | 7,507 |
| Washington AGresidents of WA | Sep 26, 2024 | 540 |
| Delaware DOJresidents of DE | Sep 26, 2024 | 2,956 |
| HHS archivetotal | Sep 26, 2024 | 242,200 |
History of this record
- 2026-09-25 · data_types: ["names"] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to CF Medical reported that it experienced a hacking incident that compromised the protected health information of 242,200 individuals. Upon starting the investigation it was determined that CF Medical was not a covered entity; therefore, the · backfill source
- 2026-09-25 · disclosed: 2024-09-26 to 2024-09-09 · backfill source
- 2026-09-25 · data_types: [] to ["names"] · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 626396 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Washington AG), confirmed by Washington AG. Record counts are as reported. Not legal advice.