Illinois Bone & Joint Institute
Disclosed Aug 30, 20242 years ago665,321 affectedConfirmed
Illinois Bone & Joint Institute, the covered entity (CE), reported that it experienced a cyber-attack that affected the protected health information (PHI) of 665,321 individuals. The PHI involved included names, addresses, birthdates, Social Security numbers, diagnoses, lab results, and medications. The CE notified HHS, affected individuals, and the media. In its mitigation efforts, the CE provided free credit monitoring and implemented additional administrative and technical safeguards.
What is known
| People affected | 665,321 (as reported to HHS) |
|---|---|
| Disclosed | Aug 30, 2024 |
| Happened | May 30, 2024 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Illinois Bone & Joint Instituteoag.ca.gov · Official notice | Official notice |
| Vermont Attorney General: 2024-12-19 Illinois Bone and Joint Institute Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Vermont Attorney General: 2024-08-30 Illinois Bone and Joint Institute Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Illinois Bone & Joint Institute (Healthcare Provider, IL)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Vermont AGresidents of VT | Aug 30, 2024 | |
| HHS archivetotal | Aug 30, 2024 | 665,321 |
| California AGresidents of CA | Dec 19, 2024 | |
| Vermont AGresidents of VT | Dec 19, 2024 |
History of this record
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 665321 · backfill source
- 2026-09-25 · summary: empty to Illinois Bone & Joint Institute, the covered entity (CE), reported that it experienced a cyber-attack that affected the protected health information (PHI) of 665,321 individuals. The PHI involved included names, addresses, birthdates, Socia · backfill source
- 2026-09-25 · disclosed: 2024-12-19 to 2024-08-30 · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2024-12-19-illinois-bone-and-joint-institute-data-breach-notice-consumers · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.