Gateway Rehabilitation Center
Disclosed Nov 18, 20223 years ago130,000 affectedConfirmed
Gateway Rehabilitation Center, the covered entity (CE), reported that it experienced a ransomware attack that compromised the protected health information (PHI) of 119,000 individuals. The PHI involved included names, addresses, phone numbers, Social Security numbers, financial information, and other treatment information. The CE notified HHS, affected individuals, and the media. In response to the incident, Gateway implemented additional administrative and technical safeguards to better protect sensitive data.
What is known
| People affected | 130,000 (as reported by the organization) |
|---|---|
| Disclosed | Nov 18, 2022 |
| Happened | Jun 13, 2022 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Vermont Attorney General: 2022 11 18 Gateway Rehabilitation Center Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Indiana Attorney General 2022 data breach report: Gateway Rehabilitation Centerin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Gateway Rehabilitation Center (Healthcare Provider, PA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Vermont AGresidents of VT | Nov 18, 2022 | |
| Indiana AGresidents of IN | Nov 18, 2022 | 46 |
| HHS archivetotal | Nov 18, 2022 | 119,000 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to Gateway Rehabilitation Center, the covered entity (CE), reported that it experienced a ransomware attack that compromised the protected health information (PHI) of 119,000 individuals. The PHI involved included names, addresses, phone numbe · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 130000 · backfill source
- 2026-09-25 · occurred: empty to 2022-06-13 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Vermont AG), confirmed by Vermont AG. Record counts are as reported. Not legal advice.