Guidehouse
Disclosed Jul 15, 20215 years ago91,331 affectedConfirmed
The covered entity (CE), Guidehouse, reported that its secure file transfer device experienced a cyber-attack that affected the protected health information (PHI) of approximately 91,331 individuals. The PHI involved included, names, dates of birth, diagnoses/conditions, and claims information. The CE notified HHS, affected individuals, and the media. In response to the breach, the CE applied a critical patch shortly after the cyber-attack which mitigated the vulnerability. Additionally, the CE discontinued use of the file transfer device and transitioned to another network.
What is known
| People affected | 91,331 (as reported to HHS) |
|---|---|
| Disclosed | Jul 15, 2021 |
| Happened | Jan 20, 2021 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Guidehouseoag.ca.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Guidehouse (Business Associate, VA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Jul 15, 2021 | 91,331 |
| California AGresidents of CA | Jul 16, 2021 |
History of this record
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 91331 · backfill source
- 2026-09-25 · disclosed: 2021-07-16 to 2021-07-15 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Guidehouse, reported that its secure file transfer device experienced a cyber-attack that affected the protected health information (PHI) of approximately 91,331 individuals. The PHI involved included, names, dates · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.