Breachesby GlyphMay Institute
Disclosed Feb 12, 20242,612 affectedConfirmed
The covered entity (CE), May Institute, reported that it experienced a ransomware attack that affected the protected health information (PHI) of 2,612 individuals. The PHI affected included names, social security numbers, addresses, drivers’ license numbers, dates of birth, medications, diagnoses, and other treatment information. The CE notified HHS, the affected individuals, and the media. In response to the breach, the CE provided complimentary credit monitoring and identity theft protections services and implemented additional administrative and technical safeguards.
What is known
| People affected | 2,612 (as reported to HHS) |
|---|---|
| Disclosed | Feb 12, 2024 |
| Happened | Dec 4, 2023 |
| Attack | Hacking |
| Data exposed | NamesHealth |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
California Attorney General breach notice: May InstituteVermont Attorney General: 2024-05-07 The May Institute Data Breach Notice to ConsumersVermont Attorney General: 2024-04-01 The May Institute Data Breach Notice to ConsumersHHS OCR breach report (archive, resolved): May Institute (Healthcare Provider, MA)
Notices filed
History of this record
other to healthby backfillSource
unknown to hackingby backfillSource
[] to ["names","health"]by backfillSource
empty to hhsby backfillSource
empty to 2612by backfillSource
2024-04-01 to 2024-02-12by backfillSource
empty to The covered entity (CE), May Institute, reported that it experienced a ransomware attack that affected the protected health information (PHI) of 2,612 individuals. The PHI affected included names, social security numbers, addresses, driversby backfillSource
2024-05-07 to 2024-04-01by backfillSource
empty to https://ago.vermont.gov/document/2024-05-07-may-institute-data-breach-notice-consumersby backfillSource
First recordedby backfillSource
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.