Duneland School
Disclosed Dec 23, 20214 years ago7,000 affectedConfirmed
The covered entity (CE), Duneland School Corporation, reported that it experienced a cyber-attack affecting the protected health information (PHI) of 7,000 individuals. The PHI involved included names, addresses, dates of birth, Social Security numbers, and employee benefits information. The CE notified HHS, affected individuals, the media, and provided substitute notice. In response to the breach, the CE provided complimentary credit monitoring services and implemented additional administrative, technical, and security safeguards. Staff were retrained.
What is known
| People affected | 7,000 (as reported to HHS) |
|---|---|
| Disclosed | Dec 23, 2021 |
| Happened | Oct 21, 2021 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Education · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Indiana Attorney General 2021 data breach report: Duneland Schoolin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Duneland School (Health Plan, IN)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Dec 23, 2021 | 3,909 |
| HHS archivetotal | Dec 23, 2021 | 7,000 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 4157 to 7000 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Duneland School Corporation, reported that it experienced a cyber-attack affecting the protected health information (PHI) of 7,000 individuals. The PHI involved included names, addresses, dates of birth, Social Secu · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.