May Institute
Disclosed Feb 12, 20242 years ago2,612 affectedConfirmed
The covered entity (CE), May Institute, reported that it experienced a ransomware attack that affected the protected health information (PHI) of 2,612 individuals. The PHI affected included names, social security numbers, addresses, drivers’ license numbers, dates of birth, medications, diagnoses, and other treatment information. The CE notified HHS, the affected individuals, and the media. In response to the breach, the CE provided complimentary credit monitoring and identity theft protections services and implemented additional administrative and technical safeguards.
What is known
| People affected | 2,612 (as reported to HHS) |
|---|---|
| Disclosed | Feb 12, 2024 |
| Happened | Dec 4, 2023 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: May Instituteoag.ca.gov · Official notice | Official notice |
| Vermont Attorney General: 2024-05-07 The May Institute Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Vermont Attorney General: 2024-04-01 The May Institute Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): May Institute (Healthcare Provider, MA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Feb 12, 2024 | 2,612 |
| Vermont AGresidents of VT | Apr 1, 2024 | |
| California AGresidents of CA | May 7, 2024 | |
| Vermont AGresidents of VT | May 7, 2024 |
History of this record
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 2612 · backfill source
- 2026-09-25 · disclosed: 2024-04-01 to 2024-02-12 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), May Institute, reported that it experienced a ransomware attack that affected the protected health information (PHI) of 2,612 individuals. The PHI affected included names, social security numbers, addresses, drivers · backfill source
- 2026-09-25 · disclosed: 2024-05-07 to 2024-04-01 · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2024-05-07-may-institute-data-breach-notice-consumers · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.