Legacy Professionals
Disclosed Feb 27, 20251 year ago216,752 affectedConfirmed
The business associate (BA), Legacy Professionals, LLP, reported that it experienced a hacking incident that affected the protected health information (PHI) of 216,752 individuals. The PHI involved included clinical, demographic, and financial information. The BA notified HHS, the affected individuals, the media, and provided substitute notice. In response to the breach, the BA provided complimentary credit monitoring services to the affected individuals and implemented additional administrative, technical, and security safeguards. Staff were retrained.
What is known
| People affected | 216,752 (as reported to HHS) |
|---|---|
| Disclosed | Feb 27, 2025 |
| Discovered | Apr 27, 2024 |
| Happened | Apr 25, 2024 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Finance · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Legacy Professionalsoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Legacy Professionalsatg.wa.gov · Official notice | Official notice |
| Indiana Attorney General 2025 data breach report: Legacy Professionalsin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Legacy Professionals (Business Associate, IL)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Feb 27, 2025 | 29,300 |
| California AGresidents of CA | Feb 28, 2025 | |
| HHS archivetotal | Feb 28, 2025 | 216,752 |
| Washington AGresidents of WA | May 9, 2025 | 890 |
History of this record
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 190818 to 216752 · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), Legacy Professionals, LLP, reported that it experienced a hacking incident that affected the protected health information (PHI) of 216,752 individuals. The PHI involved included clinical, demographic, and financ · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 190818 · backfill source
- 2026-09-25 · disclosed: 2025-02-28 to 2025-02-27 · backfill source
- 2026-09-25 · sector: other to finance · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2024-04-27 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.