Morley Companies
Disclosed Jan 26, 20224 years ago659,339 affectedConfirmed
The covered entity (CE), Morley Companies, reported that it experienced a data security incident that affected the protected health information (PHI) of 659,194 individuals. The PHI involved included names, addresses, dates of birth, health insurance information, medications, conditions, Social Security numbers, and other treatment information. The CE notified HHS, the affected individuals, the media, and provided substitute notice. In response to the breach, the CE provided complimentary credit monitoring services and implemented additional administrative, technical, and security safeguards to better protect its PHI.
What is known
| People affected | 659,339 (as reported by the organization) |
|---|---|
| Disclosed | Jan 26, 2022 |
| Discovered | Aug 1, 2021 |
| Happened | Jul 20, 2021 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Morley Companiesoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Morley Companiesatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Morley Companiesjustice.oregon.gov · Official notice | Official notice |
| Indiana Attorney General 2022 data breach report: Morley Companiesin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Morley Companies (Business Associate, MI)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Jan 26, 2022 | 24,156 |
| California AGresidents of CA | Feb 1, 2022 | |
| HHS archivetotal | Feb 1, 2022 | 659,194 |
| Oregon DOJresidents of OR | Feb 8, 2022 | 590,785 |
| California AGresidents of CA | Mar 21, 2022 | |
| Washington AGresidents of WA | Mar 21, 2022 | 42,633 |
History of this record
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Morley Companies, reported that it experienced a data security incident that affected the protected health information (PHI) of 659,194 individuals. The PHI involved included names, addresses, dates of birth, health · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 659339 · backfill source
- 2026-09-25 · disclosed: 2022-02-01 to 2022-01-26 · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2021-08-01 · backfill source
- 2026-09-25 · disclosed: 2022-03-21 to 2022-02-01 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.