NASCO
Disclosed Oct 10, 20232 years ago1,744,655 affectedConfirmed
The business associate (BA), NASCO, reported that a software application exposed the protected health information (PHI) of 1,744,655 individuals. The PHI involved included names, dates of birth, addresses, Social Security numbers, diagnoses, claims and health insurance information, and other treatment information. The BA notified HHS, the affected individuals, the media, and provided substitute notice. In response to the breach, the BA provided complimentary credit monitoring services and implemented additional administrative, technical, and security safeguards to better protect PHI.
What is known
| People affected | 1,744,655 (as reported to HHS) |
|---|---|
| Disclosed | Oct 10, 2023 |
| Discovered | Jul 12, 2023 |
| Happened | May 30, 2023 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: NASCOoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: NASCOatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: NASCOjustice.oregon.gov · Official notice | Official notice |
| Vermont Attorney General: 2024-01-08 NASCO Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Vermont Attorney General: 2023-10-27 NASCO Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): NASCO (Business Associate, GA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Oct 10, 2023 | 1,744,655 |
| California AGresidents of CA | Oct 27, 2023 | |
| Washington AGresidents of WA | Oct 27, 2023 | 12,986 |
| Oregon DOJresidents of OR | Oct 27, 2023 | 804,862 |
| Vermont AGresidents of VT | Oct 27, 2023 | |
| Vermont AGresidents of VT | Jan 8, 2024 | |
| California AGresidents of CA | Jan 10, 2024 |
History of this record
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 1744655 · backfill source
- 2026-09-25 · disclosed: 2023-10-27 to 2023-10-10 · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), NASCO, reported that a software application exposed the protected health information (PHI) of 1,744,655 individuals. The PHI involved included names, dates of birth, addresses, Social Security numbers, diagnoses · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2023-10-27-nasco-data-breach-notice-consumers · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2024-01-08-nasco-data-breach-notice-consumers · backfill source
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2023-07-12 · backfill source
- 2026-09-25 · disclosed: 2024-01-10 to 2023-10-27 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.