Breachesby GlyphHumana
Disclosed Jun 15, 202312,539 affectedConfirmed
The covered entity (CE), Humana, reported that an unauthorized individual gained access to the protected health information (PHI) of 12,339 individuals using data it obtained elsewhere. The type of PHI affected included names, addresses, dates of birth, diagnoses, and other treatment information. The CE notified HHS and the affected individuals. In response to the breach, Humana implemented additional administrative and technical safeguards.
What is known
| People affected | 12,539 (as reported to HHS) |
|---|---|
| Disclosed | Jun 15, 2023 |
| Discovered | Sep 22, 2023 |
| Happened | Jul 31, 2023 |
| Attack | Hacking |
| Data exposed | NamesHealth |
| Sector | Finance · US |
| Status | Confirmed |
Sources
Notices filed
Other breaches at Humana
Breach, details not statedBreach notice filed with the Indiana AG, details not stated.10 affectedFinanceUSOct 22Breach, details not statedExposed Social Security numbers, health records, insurance details, dates of birth, addresses and names. Reported to the Indiana AG.16K affectedInsuranceUSApr 29, 2025Hacking breachHacking exposed names and health records. Reported to the California AG.23K affectedHealthcareUSSep 9, 2021Lost or stolen device breachLost or stolen device exposed names and health records. Reported to the California AG.65K affectedHealthcareUSAug 19, 2020Insider breachInsider exposed names and health records. Reported to the HHS archive.5,569 affectedHealthcareUSDec 31, 2018Insider breachInsider exposed names, health records, biometric data and Social Security numbers. Reported to the California AG.6,836 affectedFinanceUSNov 21, 2017Breach, details not statedBreach notice filed with the Indiana AG, details not stated.FinanceUSMay 23, 2014
History of this record
2023-09-22 to 2023-06-15by backfillSource
12339 to 12539by backfillSource
["names"] to ["names","health"]by backfillSource
empty to hhsby backfillSource
empty to 12339by backfillSource
empty to The covered entity (CE), Humana, reported that an unauthorized individual gained access to the protected health information (PHI) of 12,339 individuals using data it obtained elsewhere. The type of PHI affected included names, addresses, daby backfillSource
[] to ["names"]by backfillSource
2023-12-13 to 2023-09-22by backfillSource
other to financeby backfillSource
unknown to hackingby backfillSource
empty to 2023-09-22by backfillSource
First recordedby backfillSource
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.