Lyons Companies
Disclosed Aug 23, 20197 years ago8,002 affectedConfirmed
The covered entity (CE), Lyons Company, reported that several employees were the victims of an email phishing scheme that affected the electronic protected health information (ePHI) of 2,434 individuals. The ePHI involved included names, addresses, Social Security numbers, drivers’ license numbers, health insurance information, treatment information, and financial information. After the breach, the CE implemented additional technical and security safeguards to better protect its sensitive data. Workforce members were trained on the proper methods for identifying fraudulent email communications.
What is known
| People affected | 8,002 (as reported by the organization) |
|---|---|
| Disclosed | Aug 23, 2019 |
| Happened | Feb 4, 2019 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Notice letter filed with the Delaware DOJ: Lyons Companiesattorneygeneral.delaware.gov · Official notice | Official notice |
| Indiana Attorney General 2019 data breach report: Lyons Companiesin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Lyons Companies (Business Associate, PA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Delaware DOJresidents of DE | Aug 23, 2019 | 5,067 |
| Indiana AGresidents of IN | Aug 23, 2019 | 7 |
| HHS archivetotal | Aug 23, 2019 | 1,982 |
History of this record
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: ["names"] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Lyons Company, reported that several employees were the victims of an email phishing scheme that affected the electronic protected health information (ePHI) of 2,434 individuals. The ePHI involved included names, ad · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 8002 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Delaware DOJ), confirmed by Delaware DOJ. Record counts are as reported. Not legal advice.