Every public data breach

Disclosed this week47On record26,367

47 disclosed this week · 26,367 on record

Humana

Disclosed Sep 9, 202122,767 affectedConfirmed

Official notice

The covered entity (CE), Humana, reported that its business associate (BA) experienced a ransomware attack that affected the electronic protected health information (ePHI) of 1,823 individuals. The ePHI involved included names, addresses, dates of birth, Social Security numbers, diagnoses and medical conditions, medications prescribed, and other treatment information. The CE notified HHS and the BA notified affected individuals, the media, and provided complimentary credit monitoring services. OCR provided the CE with technical assistance regarding the HIPAA Breach Notification Rule.

What is known

People affected22,767 (as reported by the organization)
DisclosedSep 9, 2021
DiscoveredAug 5, 2022
HappenedMay 7, 2022
AttackHacking
Data exposedNamesHealth
SectorHealthcare · US
StatusConfirmed

Sources

Official noticeoag.ca.gov
California Attorney General breach notice: Humana
Official noticeatg.wa.gov
Washington Attorney General breach notice: Humana
Official noticein.gov
Indiana Attorney General 2022 data breach report: Humana
Official noticein.gov
Indiana Attorney General 2021 data breach report: Humana
Official noticeocrportal.hhs.gov
HHS OCR breach report (archive, resolved): Humana (Health Plan, KY)

Notices filed

Residents of INSep 9, 2021
Indiana AG3 people
TotalSep 28, 2021
HHS archive948 people
TotalOct 12, 2021
HHS archive4,424 people
TotalNov 4, 2021
HHS archive1,965 people
TotalNov 9, 2021
HHS archive1,823 people
Residents of INNov 12, 2021
Indiana AG1 person
Residents of CADec 6, 2021
California AGCount not stated
Residents of INJun 8, 2022
Indiana AG515 people
Residents of WASep 8, 2022
Washington AG639 people
Residents of CASep 21, 2022
California AGCount not stated

Other breaches at Humana

Breach, details not statedBreach notice filed with the Indiana AG, details not stated.10 affectedFinanceUSOct 22Breach, details not statedExposed Social Security numbers, health records, insurance details, dates of birth, addresses and names. Reported to the Indiana AG.16K affectedInsuranceUSApr 29, 2025Hacking breachHacking exposed names and health records. Reported to the California AG.13K affectedFinanceUSJun 15, 2023Lost or stolen device breachLost or stolen device exposed names and health records. Reported to the California AG.65K affectedHealthcareUSAug 19, 2020Insider breachInsider exposed names and health records. Reported to the HHS archive.5,569 affectedHealthcareUSDec 31, 2018Insider breachInsider exposed names, health records, biometric data and Social Security numbers. Reported to the California AG.6,836 affectedFinanceUSNov 21, 2017Breach, details not statedBreach notice filed with the Indiana AG, details not stated.FinanceUSMay 23, 2014
History of this record
data_types2026-09-25
[] to ["names","health"]by backfillSource
summary2026-09-25
empty to The covered entity (CE), Humana, reported that its business associate (BA) experienced a ransomware attack that affected the electronic protected health information (ePHI) of 1,823 individuals. The ePHI involved included names, addresses, dby backfillSource
disclosed2026-09-25
2021-12-06 to 2021-09-09by backfillSource
records_basis2026-09-25
empty to organizationby backfillSource
records2026-09-25
empty to 22767by backfillSource
sector2026-09-25
other to healthby backfillSource
attack2026-09-25
unknown to hackingby backfillSource
discovered2026-09-25
empty to 2022-08-05by backfillSource
disclosed2026-09-25
2022-09-21 to 2021-12-06by backfillSource
Added2026-09-25
First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Humana