HealthEquity
Disclosed Jul 2, 20242 years ago4,300,000 affectedConfirmed
Compromised partner account exposes data of 4.3 million HealthEquity users
HealthEquity said a business partner's compromised user account was used to access an unstructured data repository outside its core network containing members' personal and health information. It notified about 4.3 million people, with data including Social Security numbers, employer details and some diagnosis and prescription information.
What is known
| People affected | 4,300,000 (as reported by the organization) |
|---|---|
| Disclosed | Jul 2, 2024 |
| Discovered | Mar 25, 2024 |
| Happened | Mar 9, 2024 |
| Attack | Vendor breach |
| Data exposed | Names, Health, Addresses, Phone numbers, Social Security numbers, Employment, Payment cards |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: HealthEquityoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: HealthEquityatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: HealthEquityjustice.oregon.gov · Official notice | Official notice |
| HHS OCR breach report: HealthEquity (Business Associate, UT)ocrportal.hhs.gov · Official notice | Official notice |
| California AG breach notice: HealthEquity, Inc.oag.ca.gov · Regulator | Regulator |
| HealthEquity data breach affects 4.3M peopletechcrunch.com · News | News |
| HealthEquity Form 8-K (July 2, 2024)sec.gov · SEC filing | SEC filing |
| Vermont Attorney General: 2024-07-26 HealthEquity Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Jul 2, 2024 | 4,300,000 |
| California AGresidents of CA | Jul 26, 2024 | |
| Washington AGresidents of WA | Jul 26, 2024 | 102,140 |
| Oregon DOJresidents of OR | Jul 26, 2024 | 4,300,000 |
| Vermont AGresidents of VT | Jul 26, 2024 | |
| HHS archivetotal | Aug 9, 2024 | 4,300,000 |
| HHS OCRtotal | Dec 20, 2024 | 1,549 |
| California AGresidents of CA | Mar 21, 2025 | |
| California AGresidents of CA | Apr 9, 2025 | |
| California AGresidents of CA | Apr 17, 2025 | |
| California AGresidents of CA | May 13, 2025 | |
| California AGresidents of CA | May 15, 2025 | |
| California AGresidents of CA | May 16, 2025 |
Other breaches at HealthEquity
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Jun 12, 2018Jun 12, 20188 years agoPhishing | Jun 12, 20188 years ago | Phishing | Healthcare | Confirmed | 166K |
| Disclosed Jan 25, 2016Jan 25, 201610 years ago | Jan 25, 201610 years ago | Not stated | Healthcare | Confirmed | Unknown |
History of this record
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2024-07-26-healthequity-data-breach-notice-consumers · backfill source
- 2026-09-25 · attack: hacking to third-party · seed source
- 2026-09-25 · data_types: ["names","health"] to ["names","health","addresses","phone","ssn","employment","payment-card"] · seed source
- 2026-09-25 · records_basis: hhs to organization · seed source
- 2026-09-25 · records: 1549 to 4300000 · seed source
- 2026-09-25 · disclosed: 2024-07-26 to 2024-07-02 · seed source
- 2026-09-25 · summary: empty to HealthEquity said a business partner's compromised user account was used to access an unstructured data repository outside its core network containing members' personal and health information. It notified about 4.3 million people, with data · seed source
- 2026-09-25 · title: empty to Compromised partner account exposes data of 4.3 million HealthEquity users · seed source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 1549 · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2024-03-25 · backfill source
- 2026-09-25 · disclosed: 2025-03-21 to 2024-07-26 · backfill source
- 2026-09-25 · disclosed: 2025-04-09 to 2025-03-21 · backfill source
- 2026-09-25 · disclosed: 2025-04-17 to 2025-04-09 · backfill source
- 2026-09-25 · disclosed: 2025-05-13 to 2025-04-17 · backfill source
- 2026-09-25 · disclosed: 2025-05-15 to 2025-05-13 · backfill source
- 2026-09-25 · disclosed: 2025-05-16 to 2025-05-15 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.