Skip to content

Insulet

Disclosed Jan 5, 20233 years ago29,000 affectedConfirmed

Official notice

The covered entity (CE), Insulet Corporation, reported that it inadvertently used tracking devices on its computer systems that captured the protected health information (PHI) of 29,000 individuals. The PHI involved included names and IP addresses. The CE notified HHS, affected individuals and the media of the breach. In its mitigation efforts, the CE implemented additional technical safeguards to better protect PHI.

What is known

People affected29,000 (as reported to HHS)
DisclosedJan 5, 2023
DiscoveredDec 6, 2022
HappenedDec 1, 2022
AttackInsider
Data exposedNames, Health
SectorHealthcare · US
StatusConfirmed

Sources

Source
California Attorney General breach notice: Insuletoag.ca.gov · Official notice
Notice letter filed with the Delaware DOJ: Insuletattorneygeneral.delaware.gov · Official notice
Vermont Attorney General: 2023 01 05 Insulet Data Breach Notice to Consumersago.vermont.gov · Official notice
HHS OCR breach report (archive, resolved): Insulet (Healthcare Provider, MA)ocrportal.hhs.gov · Official notice

Notices filed

WhereFiledPeople
Delaware DOJresidents of DEJan 5, 202385
Vermont AGresidents of VTJan 5, 2023
HHS archivetotalJan 5, 202329,000
California AGresidents of CAJan 10, 2023

Other breaches at Insulet

BreachAffected
Disclosed May 16, 2025May 16, 20251 year agoInsider841
Disclosed Mar 19, 2021Mar 19, 20215 years agoHacking9,050
Disclosed Oct 17, 2017Oct 17, 20178 years agoInsider1,469
History of this record
  • 2026-09-25 · attack: unknown to insider · backfill source
  • 2026-09-25 · data_types: ["names"] to ["names","health"] · backfill source
  • 2026-09-25 · records_basis: empty to hhs · backfill source
  • 2026-09-25 · records: empty to 29000 · backfill source
  • 2026-09-25 · summary: empty to The covered entity (CE), Insulet Corporation, reported that it inadvertently used tracking devices on its computer systems that captured the protected health information (PHI) of 29,000 individuals. The PHI involved included names and IP ad · backfill source
  • 2026-09-25 · sector: other to health · backfill source
  • 2026-09-25 · data_types: [] to ["names"] · backfill source
  • 2026-09-25 · disclosed: 2023-01-10 to 2023-01-05 · backfill source
  • 2026-09-25 · discovered: empty to 2022-12-06 · backfill source
  • 2026-09-25 · added · backfill source

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Insulet

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.