Skip to content

Keenan & Associates

Disclosed Dec 11, 20232 years ago1,475,991 affectedConfirmed

Official notice

The covered entity (CE), Keenan & Associates, reported that it experienced a hacking/IT incident that affected the protected health information (PHI) of 1,475,991 individuals. The PHI involved demographic, clinical, and financial information. The CE notified HHS, affected individuals, and the media and provided affected individuals with free credit monitoring. In response to the breach, the CE changed password/strengthened password requirements and implemented new technical safeguards.

What is known

People affected1,475,991 (as reported to HHS)
DisclosedDec 11, 2023
DiscoveredAug 27, 2023
HappenedAug 21, 2023
AttackRansomware
Data exposedNames, Health
SectorInsurance · US
StatusConfirmed

Sources

Source
California Attorney General breach notice: Keenan & Associatesoag.ca.gov · Official notice
Washington Attorney General breach notice: Keenan & Associatesatg.wa.gov · Official notice
Oregon DOJ breach notice: Keenan & Associatesjustice.oregon.gov · Official notice
Vermont Attorney General: 2024-01-26 Keenan & Associates Data Breach Notice to Consumersago.vermont.gov · Official notice
HHS OCR breach report (archive, resolved): Keenan & Associates (Health Plan, CA)ocrportal.hhs.gov · Official notice

Notices filed

WhereFiledPeople
California AGresidents of CADec 11, 2023
HHS archivetotalDec 11, 20231,475,991
California AGresidents of CAJan 26, 2024
Washington AGresidents of WAJan 26, 20245,873
Oregon DOJresidents of ORJan 26, 20241,509,616
Vermont AGresidents of VTJan 26, 2024
California AGresidents of CAApr 11, 2024

Other breaches at Keenan & Associates

BreachAffected
Disclosed Nov 20, 2015Nov 20, 201510 years agoInsider35K
History of this record
  • 2026-09-25 · sector: other to insurance · backfill source
  • 2026-09-25 · data_types: [] to ["names","health"] · backfill source
  • 2026-09-25 · records_basis: empty to hhs · backfill source
  • 2026-09-25 · records: empty to 1475991 · backfill source
  • 2026-09-25 · summary: empty to The covered entity (CE), Keenan & Associates, reported that it experienced a hacking/IT incident that affected the protected health information (PHI) of 1,475,991 individuals. The PHI involved demographic, clinical, and financial informatio · backfill source
  • 2026-09-25 · source: empty to https://ago.vermont.gov/document/2024-01-26-keenan-associates-data-breach-notice-consumers · backfill source
  • 2026-09-25 · attack: unknown to ransomware · backfill source
  • 2026-09-25 · discovered: empty to 2023-08-27 · backfill source
  • 2026-09-25 · disclosed: 2024-01-26 to 2023-12-11 · backfill source
  • 2026-09-25 · disclosed: 2024-04-11 to 2024-01-26 · backfill source
  • 2026-09-25 · added · backfill source

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Keenan & Associates

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.