Breachesby GlyphDefense Health Agency
Disclosed Mar 12, 202696,271 affectedConfirmed
The covered entity (CE), Defense Health Agency, reported that several employees were the targets of an email phishing scheme that affected the protected health information (PHI) of approximately 11,844 individuals. The PHI involved names, addresses, dates of birth, other identifiers, claims information, diagnoses/conditions, and other treatment information. The CE notified HHS, the media, and the affected individuals. OCR provided technical assistance to the CE regarding the HIPAA Rules.
What is known
| People affected | 96,271 (as reported to HHS) |
|---|---|
| Disclosed | Mar 12, 2026 |
| Attack | Insider |
| Data exposed | NamesHealth |
| Sector | Insurance · US |
| Status | Confirmed |
Sources
Notices filed
Other breaches at Defense Health Agency
History of this record
11844 to 96271by backfillSource
2026-04-14 to 2026-03-12by backfillSource
1300 to 11844by backfillSource
empty to The covered entity (CE), Defense Health Agency, reported that several employees were the targets of an email phishing scheme that affected the protected health information (PHI) of approximately 11,844 individuals. The PHI involved names, aby backfillSource
First recordedby backfillSource
First seen 2026-09-25 (HHS OCR), confirmed by HHS OCR. Record counts are as reported. Not legal advice.