Episource

Disclosed Jun 2, 202323,557 affectedConfirmed

The business associate (BA), Episource, reported that it experienced a cyber-attack that compromised the protected health information (PHI) of 23,557 individuals. The PHI involved included names, dates of birth, addresses, phone numbers, medical record numbers, health insurance information, diagnoses, medications, lab results, and other treatment information. The BA notified HHS, the affected individuals, the media, and provided substitute notice. In response to the breach, the BA provided complimentary credit monitoring services and implemented additional administrative, technical, and security safeguards.

What is known

People affected	23,557 (as reported to HHS)
Disclosed	Jun 2, 2023
Discovered	Feb 20, 2023
Happened	Feb 19, 2023
Attack	Hacking
Data exposed	NamesHealth
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: EpiSource

Official noticejustice.oregon.gov

Oregon DOJ breach notice: EpiSource

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): Episource (Business Associate, MN)

Notices filed

Residents of CAJun 2, 2023

California AGCount not stated

TotalJun 2, 2023

HHS archive23,557 people

Residents of ORJun 9, 2023

Oregon DOJ23,557 people

Other breaches at Episource

Ransomware attack on Episource exposes health data of 6.7 millionRansomware exposed names, health records, addresses, dates of birth, Social Security numbers and insurance details. Reported to the California AG.Ransomware6.7M affectedHealthcareUSJun 6, 2025

History of this record

attack2026-09-25

unknown to hackingby backfillSource

data_types2026-09-25

[] to ["names","health"]by backfillSource

records_basis2026-09-25

empty to hhsby backfillSource

records2026-09-25

empty to 23557by backfillSource

summary2026-09-25

empty to The business associate (BA), Episource, reported that it experienced a cyber-attack that compromised the protected health information (PHI) of 23,557 individuals. The PHI involved included names, dates of birth, addresses, phone numbers, meby backfillSource

sector2026-09-25

other to healthby backfillSource

discovered2026-09-25

empty to 2023-02-20by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Episource