Little Rock Cancer Clinic
Disclosed Mar 11, 20197 years ago3,804 affectedConfirmed
The covered entity (CE), Little Rock Cancer Clinic, P.A., experienced a ransomware attack that affected the electronic protected health information (ePHI) of 3,804 individuals. The ePHI involved included names, addresses, dates of birth, Social Security numbers, and financial and clinical information. The CE notified HHS, affected individuals, and the media. In response to the breach, the CE developed new policies and procedures and implemented additional technical safeguards to better protect its ePHI. OCR obtained assurances that the CE implemented the corrective actions noted.
What is known
| People affected | 3,804 (as reported to HHS) |
|---|---|
| Disclosed | Mar 11, 2019 |
| Happened | Jan 10, 2019 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Indiana Attorney General 2019 data breach report: Little Rock Cancer Clinicin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Little Rock Cancer Clinic (Healthcare Provider, AR)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Mar 11, 2019 | 2 |
| HHS archivetotal | Mar 11, 2019 | 3,804 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 3078 to 3804 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Little Rock Cancer Clinic, P.A., experienced a ransomware attack that affected the electronic protected health information (ePHI) of 3,804 individuals. The ePHI involved included names, addresses, dates of birth, So · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.