Horizon House
Disclosed Sep 17, 20215 years ago35,107 affectedConfirmed
The covered entity (CE), Horizon House, reported that it experienced a ransomware attack that compromised the protected health information (PHI) of approximately 27,823 individuals. The PHI involved included names, dates of birth, drivers’ license numbers, addresses, Social Security numbers, claims and financial information, diagnoses, and other treatment information. The CE notified HHS, affected individuals, the media, and provided substitute notice on its website. In its mitigation efforts, the CE implemented additional administrative, technical, and security safeguards to better protect its PHI. OCR provided technical assistance regarding the HIPAA Security Rule.
What is known
| People affected | 35,107 (as reported by the organization) |
|---|---|
| Disclosed | Sep 17, 2021 |
| Discovered | Sep 3, 2021 |
| Happened | Mar 2, 2021 |
| Attack | Hacking |
| Data exposed | Names, Government IDs, Health, Insurance, Credentials and tokens |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Notice letter filed with the Delaware DOJ: Horizon Houseattorneygeneral.delaware.gov · Official notice | Official notice |
| Indiana Attorney General 2021 data breach report: Horizon Housein.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Horizon House (Healthcare Provider, PA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Delaware DOJresidents of DE | Sep 17, 2021 | 6,927 |
| Indiana AGresidents of IN | Sep 17, 2021 | 3 |
| HHS archivetotal | Sep 17, 2021 | 27,823 |
History of this record
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Horizon House, reported that it experienced a ransomware attack that compromised the protected health information (PHI) of approximately 27,823 individuals. The PHI involved included names, dates of birth, drivers’ · backfill source
- 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/Data-Breach-Year-to-date-Report-2021-1.pdf · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Delaware DOJ), confirmed by Delaware DOJ. Record counts are as reported. Not legal advice.