Hafetz & Associates
Disclosed Jun 28, 20242 years ago26,474 affectedConfirmed
The covered entity (CE), Hafetz and Associates, reported that multiple employees were the subjects of an email phishing scheme that affected the protected health information (PHI) of 26,474 individuals. The PHI involved included names, dates of birth, Social Security and drivers’ license numbers, addresses medications, claims and financial information, and health insurance information. The CE notified HHS, affected individuals, the media, and posted substitute notice on its website. In its mitigation efforts, the CE implemented additional administrative, technical, and security safeguards to better protect its PHI.
What is known
| People affected | 26,474 (as reported to HHS) |
|---|---|
| Disclosed | Jun 28, 2024 |
| Happened | Jul 24, 2023 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Indiana Attorney General 2024 data breach report: Hafetz & Associatesin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Hafetz and Associates (Business Associate, NJ)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Jun 28, 2024 | 1 |
| HHS archivetotal | Sep 27, 2024 | 26,474 |
History of this record
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 2391 to 26474 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Hafetz and Associates, reported that multiple employees were the subjects of an email phishing scheme that affected the protected health information (PHI) of 26,474 individuals. The PHI involved included names, date · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.