Breachesby GlyphHealthEquity
Disclosed Jul 2, 20244,300,000 affectedConfirmed
Compromised partner account exposes data of 4.3 million HealthEquity users
HealthEquity said a business partner's compromised user account was used to access an unstructured data repository outside its core network containing members' personal and health information. It notified about 4.3 million people, with data including Social Security numbers, employer details and some diagnosis and prescription information.
What is known
| People affected | 4,300,000 (as reported by the organization) |
|---|---|
| Disclosed | Jul 2, 2024 |
| Discovered | Mar 25, 2024 |
| Happened | Mar 9, 2024 |
| Attack | Vendor breach |
| Data exposed | NamesHealthAddressesPhone numbersSocial Security numbersEmploymentPayment cards |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
California Attorney General breach notice: HealthEquityWashington Attorney General breach notice: HealthEquityOregon DOJ breach notice: HealthEquityHHS OCR breach report: HealthEquity (Business Associate, UT)California AG breach notice: HealthEquity, Inc.HealthEquity data breach affects 4.3M peopleHealthEquity Form 8-K (July 2, 2024)Vermont Attorney General: 2024-07-26 HealthEquity Data Breach Notice to Consumers
Notices filed
Research4,300,000 peopleCalifornia AGCount not statedWashington AG102,140 peopleOregon DOJ4,300,000 peopleVermont AGCount not statedHHS archive4,300,000 peopleHHS OCR1,549 peopleCalifornia AGCount not statedCalifornia AGCount not statedCalifornia AGCount not statedCalifornia AGCount not statedCalifornia AGCount not statedCalifornia AGCount not stated
Other breaches at HealthEquity
History of this record
empty to https://ago.vermont.gov/document/2024-07-26-healthequity-data-breach-notice-consumersby backfillSource
hacking to third-partyby seedSource
["names","health"] to ["names","health","addresses","phone","ssn","employment","payment-card"]by seedSource
hhs to organizationby seedSource
1549 to 4300000by seedSource
2024-07-26 to 2024-07-02by seedSource
empty to HealthEquity said a business partner's compromised user account was used to access an unstructured data repository outside its core network containing members' personal and health information. It notified about 4.3 million people, with databy seedSource
empty to Compromised partner account exposes data of 4.3 million HealthEquity usersby seedSource
[] to ["names","health"]by backfillSource
empty to hhsby backfillSource
empty to 1549by backfillSource
unknown to hackingby backfillSource
empty to 2024-03-25by backfillSource
2025-03-21 to 2024-07-26by backfillSource
2025-04-09 to 2025-03-21by backfillSource
2025-04-17 to 2025-04-09by backfillSource
2025-05-13 to 2025-04-17by backfillSource
2025-05-15 to 2025-05-13by backfillSource
2025-05-16 to 2025-05-15by backfillSource
First recordedby backfillSource
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.