Gunster, Yoakley & Stewart
Disclosed Aug 4, 20233 years ago545,575 affectedConfirmed
The business associate (BA), Gunster, Yoakley, & Stewart, reported that it experienced a cyber-attack that compromised the protected health information (PHI) of 42,077 individuals. The PHI involved included names, addresses, dates of birth, drivers’ license and Social Security numbers, claims information, diagnoses, lab results, and medications. The BA notified HHS, affected individuals, the media, and provided substitute notice on its website. In response to the breach, the CE provided complimentary credit monitoring services and implemented additional administrative, technical, and security safeguards.
What is known
| People affected | 545,575 (as reported by the organization) |
|---|---|
| Disclosed | Aug 4, 2023 |
| Discovered | Nov 27, 2022 |
| Happened | Nov 27, 2022 |
| Attack | Hacking |
| Data exposed | Names, Government IDs, Health, Insurance, Credentials and tokens |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Notice letter filed with the Delaware DOJ: Gunster, Yoakley & Stewartattorneygeneral.delaware.gov · Official notice | Official notice |
| Indiana Attorney General 2023 data breach report: Gunster, Yoakley, & Stewartin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Gunster, Yoakley, & Stewart (Business Associate, FL)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Aug 4, 2023 | 1 |
| Delaware DOJresidents of DE | Dec 4, 2023 | 823 |
| HHS archivetotal | Mar 8, 2024 | 42,077 |
History of this record
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), Gunster, Yoakley, & Stewart, reported that it experienced a cyber-attack that compromised the protected health information (PHI) of 42,077 individuals. The PHI involved included names, addresses, dates of birth, · backfill source
- 2026-09-25 · disclosed: 2023-12-04 to 2023-08-04 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Delaware DOJ), confirmed by Delaware DOJ. Record counts are as reported. Not legal advice.