Kelly & Associates Insurance Group
Disclosed Apr 9, 20251 year ago553,332 affectedConfirmed
What is known
| People affected | 553,332 (as reported to HHS) |
|---|---|
| Disclosed | Apr 9, 2025 |
| Discovered | Dec 12, 2024 |
| Happened | Dec 12, 2024 |
| Attack | Hacking |
| Data exposed | Names, Health, Insurance, Credentials and tokens |
| Sector | Insurance · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Kelly & Associates Insurance Groupoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Kelly & Associates Insurance Groupatg.wa.gov · Official notice | Official notice |
| Notice letter filed with the Delaware DOJ: Kelly and Associates Insurance Groupattorneygeneral.delaware.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Kelly & Associates Insurance Groupjustice.oregon.gov · Official notice | Official notice |
| HHS OCR breach report: Kelly & Associates Insurance Group (Business Associate, MD)ocrportal.hhs.gov · Official notice | Official notice |
| Indiana Attorney General 2025 data breach report: Kelly & Associates Insurance Groupin.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Apr 9, 2025 | |
| Delaware DOJresidents of DE | Apr 9, 2025 | 343 |
| HHS OCRtotal | Apr 9, 2025 | 553,332 |
| Indiana AGresidents of IN | Apr 9, 2025 | 4,747 |
| California AGresidents of CA | Apr 21, 2025 | |
| Washington AGresidents of WA | Apr 21, 2025 | 5,640 |
| Oregon DOJresidents of OR | Apr 21, 2025 | 263,893 |
| California AGresidents of CA | May 2, 2025 | |
| California AGresidents of CA | May 30, 2025 | |
| California AGresidents of CA | Jun 30, 2025 |
History of this record
- 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-2025.pdf · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 32234 to 553332 · backfill source
- 2026-09-25 · data_types: [] to ["names","health","insurance","credentials"] · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 32234 · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2024-12-12 · backfill source
- 2026-09-25 · occurred: empty to 2024-12-12 · backfill source
- 2026-09-25 · disclosed: 2025-04-21 to 2025-04-09 · backfill source
- 2026-09-25 · disclosed: 2025-05-02 to 2025-04-21 · backfill source
- 2026-09-25 · disclosed: 2025-05-30 to 2025-05-02 · backfill source
- 2026-09-25 · disclosed: 2025-06-30 to 2025-05-30 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.