CSI Financial Services
Disclosed Jul 9, 20215 years ago209,719 affectedConfirmed
The business associate (BA), CSI Financial Services, dba ClearBalance, reported that employees were the victims of an email phishing scheme that affected the electronic protected health information (ePHI) of 3,191 individuals. The ePHI involved included names, addresses, drivers’ license numbers, Social Security numbers, diagnoses, and financial information. The BA notified HHS, affected individuals, the media, and provided substitute notice. In response to the breach, the BA implemented email security controls and revised its policies and procedures to better protect its ePHI. During the investigation, OCR provided the BA with technical assistance regarding its security management process.
What is known
| People affected | 209,719 (as reported by the organization) |
|---|---|
| Disclosed | Jul 9, 2021 |
| Discovered | Apr 26, 2021 |
| Happened | Mar 8, 2021 |
| Attack | Phishing |
| Data exposed | Names, Health |
| Sector | Finance · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: CSI Financial Servicesoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: CSI Financial Servicesatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: CSI Financial Servicesjustice.oregon.gov · Official notice | Official notice |
| Indiana Attorney General 2021 data breach report: CSI Financial Servicesin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): CSI Financial Services (Business Associate, CA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Jul 9, 2021 | |
| Washington AGresidents of WA | Jul 9, 2021 | 4,255 |
| Oregon DOJresidents of OR | Jul 9, 2021 | 209,719 |
| Indiana AGresidents of IN | Jul 9, 2021 | 17,663 |
| HHS archivetotal | Jul 10, 2021 | 3,191 |
History of this record
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), CSI Financial Services, dba ClearBalance, reported that employees were the victims of an email phishing scheme that affected the electronic protected health information (ePHI) of 3,191 individuals. The ePHI invo · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 209719 · backfill source
- 2026-09-25 · attack: unknown to phishing · backfill source
- 2026-09-25 · discovered: empty to 2021-04-26 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.