Every public data breach

Disclosed this week44On record26,355

44 disclosed this week · 26,355 on record

HealthStream

Disclosed Jul 29, 20261,631 affectedConfirmed

Official notice

Cybersecurity incident disclosed to the SEC (8-K Item 8.01)

(the "Company") recently detected that the Company had experienced a cybersecurity incident in which an unauthorized third party gained access to a limited portion of files on the Company's corporate file server as described below. Following such detection, the Company initiated response protocols, launched an investigation, which remains ongoing, engaged the services of cybersecurity and forensics specialists and advisors, and notified certain law enforcement authorities. Based on the Company's investigation to date, we do not believe that any customer-facing systems were accessed or compromi

What is known

People affected1,631 (as reported by the organization)
DisclosedJul 29, 2026
HappenedJul 16, 2026
AttackVendor breach
Data exposedNamesSocial Security numbersGovernment IDs
SectorHealthcare · US
StatusConfirmed

Sources

Official noticeago.vermont.gov
Vermont Attorney General breach report: HealthStream
SEC filingsec.gov
Healthstream Inc Form 8-K, Item 8.01 (2026-07-29)
Official noticein.gov
Indiana Attorney General 2026 data breach report: HealthStream

Notices filed

TotalJul 29
SEC 8-K 8.01Count not stated
Residents of VTSep 14
Vermont AG4 people
Residents of INSep 14
Indiana AG18 people
History of this record
records_basis2026-10-02
empty to organizationby dailySource
records2026-10-02
empty to 1631by dailySource
occurred2026-10-02
empty to 2026-07-16by dailySource
attack2026-09-25
unknown to third-partyby backfillSource
disclosed2026-09-25
2026-09-14 to 2026-07-29by backfillSource
summary2026-09-25
empty to (the "Company") recently detected that the Company had experienced a cybersecurity incident in which an unauthorized third party gained access to a limited portion of files on the Company's corporate file server as described below. Followinby backfillSource
title2026-09-25
empty to Cybersecurity incident disclosed to the SEC (8-K Item 8.01)by backfillSource
Added2026-09-25
First recordedby backfillSource

First seen 2026-09-25 (Vermont AG), confirmed by Vermont AG. Record counts are as reported. Not legal advice.

Everything about HealthStream