Insulet

Disclosed Jan 5, 202329,000 affectedConfirmed

The covered entity (CE), Insulet Corporation, reported that it inadvertently used tracking devices on its computer systems that captured the protected health information (PHI) of 29,000 individuals. The PHI involved included names and IP addresses. The CE notified HHS, affected individuals and the media of the breach. In its mitigation efforts, the CE implemented additional technical safeguards to better protect PHI.

What is known

People affected	29,000 (as reported to HHS)
Disclosed	Jan 5, 2023
Discovered	Dec 6, 2022
Happened	Dec 1, 2022
Attack	Insider
Data exposed	NamesHealth
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Insulet

Official noticeattorneygeneral.delaware.gov

Notice letter filed with the Delaware DOJ: Insulet

Official noticeago.vermont.gov

Vermont Attorney General: 2023 01 05 Insulet Data Breach Notice to Consumers

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): Insulet (Healthcare Provider, MA)

Notices filed

Residents of DEJan 5, 2023

Delaware DOJ85 people

Residents of VTJan 5, 2023

Vermont AGCount not stated

TotalJan 5, 2023

HHS archive29,000 people

Residents of CAJan 10, 2023

California AGCount not stated

Other breaches at Insulet

Insider breachInsider exposed names and health records. Reported to the HHS OCR.841 affectedHealthcareUSMay 16, 2025 Hacking breachHacking exposed names and health records. Reported to the California AG.9,050 affectedHealthcareUSMar 19, 2021 Insider breachInsider exposed names and health records. Reported to the HHS archive.1,469 affectedHealthcareUSOct 17, 2017

History of this record

attack2026-09-25

unknown to insiderby backfillSource

data_types2026-09-25

["names"] to ["names","health"]by backfillSource

records_basis2026-09-25

empty to hhsby backfillSource

records2026-09-25

empty to 29000by backfillSource

summary2026-09-25

empty to The covered entity (CE), Insulet Corporation, reported that it inadvertently used tracking devices on its computer systems that captured the protected health information (PHI) of 29,000 individuals. The PHI involved included names and IP adby backfillSource

sector2026-09-25

other to healthby backfillSource

data_types2026-09-25

[] to ["names"]by backfillSource

disclosed2026-09-25

2023-01-10 to 2023-01-05by backfillSource

discovered2026-09-25

empty to 2022-12-06by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Insulet