Navvis
Disclosed Sep 22, 20233 years ago2,824,726 affectedConfirmed
The business associate (BA), Navvis & Company, LLC, reported that it experienced a phishing and ransomware attack that compromised the protected health information (PHI) of 2,824,726 individuals. The PHI involved included names, addresses, dates of birth, Social Security numbers, claims information, diagnoses/conditions, and other treatment information. The BA HHS, affected individuals, the media, and provided substitute notice. The BA offered complimentary credit monitoring services to affected individuals and implemented additional administrative and technical safeguards to better protect PHI.
What is known
| People affected | 2,824,726 (as reported by the organization) |
|---|---|
| Disclosed | Sep 22, 2023 |
| Discovered | Jul 25, 2023 |
| Happened | Jul 12, 2023 |
| Attack | Ransomware |
| Data exposed | Names, Health, Insurance |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Navvisoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Navvisatg.wa.gov · Official notice | Official notice |
| Notice letter filed with the Delaware DOJ: Navvisattorneygeneral.delaware.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Navvisjustice.oregon.gov · Official notice | Official notice |
| Vermont Attorney General: 2024-06-06 Navvis & Company Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Vermont Attorney General: 2023-10-06 Navvis & Company Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Navvis (Business Associate, MO)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Sep 22, 2023 | 2,824,726 |
| Vermont AGresidents of VT | Oct 6, 2023 | |
| California AGresidents of CA | Dec 29, 2023 | |
| Washington AGresidents of WA | Dec 29, 2023 | 6,783 |
| Oregon DOJresidents of OR | Dec 29, 2023 | 874,506 |
| California AGresidents of CA | Jan 9, 2024 | |
| California AGresidents of CA | Feb 9, 2024 | |
| California AGresidents of CA | Jun 6, 2024 | |
| Delaware DOJresidents of DE | Jun 6, 2024 | 500 |
| Vermont AGresidents of VT | Jun 6, 2024 |
History of this record
- 2026-09-25 · disclosed: 2023-10-06 to 2023-09-22 · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), Navvis & Company, LLC, reported that it experienced a phishing and ransomware attack that compromised the protected health information (PHI) of 2,824,726 individuals. The PHI involved included names, addresses, · backfill source
- 2026-09-25 · disclosed: 2023-12-29 to 2023-10-06 · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2024-06-06-navvis-company-data-breach-notice-consumers · backfill source
- 2026-09-25 · data_types: [] to ["names","health","insurance"] · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 2824726 · backfill source
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to ransomware · backfill source
- 2026-09-25 · discovered: empty to 2023-07-25 · backfill source
- 2026-09-25 · disclosed: 2024-01-09 to 2023-12-29 · backfill source
- 2026-09-25 · disclosed: 2024-02-09 to 2024-01-09 · backfill source
- 2026-09-25 · disclosed: 2024-06-06 to 2024-02-09 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.