Keenan & Associates

Disclosed Dec 11, 20231,475,991 affectedConfirmed

The covered entity (CE), Keenan & Associates, reported that it experienced a hacking/IT incident that affected the protected health information (PHI) of 1,475,991 individuals. The PHI involved demographic, clinical, and financial information. The CE notified HHS, affected individuals, and the media and provided affected individuals with free credit monitoring. In response to the breach, the CE changed password/strengthened password requirements and implemented new technical safeguards.

What is known

People affected	1,475,991 (as reported to HHS)
Disclosed	Dec 11, 2023
Discovered	Aug 27, 2023
Happened	Aug 21, 2023
Attack	Ransomware
Data exposed	NamesHealth
Sector	Insurance · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Keenan & Associates

Official noticeatg.wa.gov

Washington Attorney General breach notice: Keenan & Associates

Official noticejustice.oregon.gov

Oregon DOJ breach notice: Keenan & Associates

Official noticeago.vermont.gov

Vermont Attorney General: 2024-01-26 Keenan & Associates Data Breach Notice to Consumers

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): Keenan & Associates (Health Plan, CA)

Notices filed

Residents of CADec 11, 2023

California AGCount not stated

TotalDec 11, 2023

HHS archive1,475,991 people

Residents of CAJan 26, 2024

California AGCount not stated

Residents of WAJan 26, 2024

Washington AG5,873 people

Residents of ORJan 26, 2024

Oregon DOJ1,509,616 people

Residents of VTJan 26, 2024

Vermont AGCount not stated

Residents of CAApr 11, 2024

California AGCount not stated

Other breaches at Keenan & Associates

Insider breachInsider exposed names, Social Security numbers and health records. Reported to the California AG.35K affectedHealthcareUSNov 20, 2015

History of this record

sector2026-09-25

other to insuranceby backfillSource

data_types2026-09-25

[] to ["names","health"]by backfillSource

records_basis2026-09-25

empty to hhsby backfillSource

records2026-09-25

empty to 1475991by backfillSource

summary2026-09-25

empty to The covered entity (CE), Keenan & Associates, reported that it experienced a hacking/IT incident that affected the protected health information (PHI) of 1,475,991 individuals. The PHI involved demographic, clinical, and financial informatioby backfillSource

source2026-09-25

empty to https://ago.vermont.gov/document/2024-01-26-keenan-associates-data-breach-notice-consumersby backfillSource

attack2026-09-25

unknown to ransomwareby backfillSource

discovered2026-09-25

empty to 2023-08-27by backfillSource

disclosed2026-09-25

2024-01-26 to 2023-12-11by backfillSource

disclosed2026-09-25

2024-04-11 to 2024-01-26by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Keenan & Associates