NEC Networks

Disclosed May 5, 20212,600,000 affectedConfirmed

The business associate (BA), NEC Networks dba CaptureRx, reported that it was the victim of a ransomware attack affecting the protected health information (PHI) of approximately 2,600,000 individuals. The PHI involved included names, dates of birth, and medications. The BA notified HHS, affected individuals, the media, and posted substitute notice on its website. In response to the breach, the BA reset its passwords, provided training on security awareness, and implemented additional technical safeguards to protect its network.

What is known

People affected	2,600,000 (as reported to HHS)
Disclosed	May 5, 2021
Discovered	Feb 19, 2021
Happened	Feb 6, 2021
Attack	Hacking
Data exposed	NamesHealth
Sector	Tech · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: NEC Networks

Official noticeatg.wa.gov

Washington Attorney General breach notice: NEC Networks

Official noticeattorneygeneral.delaware.gov

Notice letter filed with the Delaware DOJ: NEC Networks

Official noticejustice.oregon.gov

Oregon DOJ breach notice: NEC Networks

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): NEC Networks (Business Associate, TX)

Notices filed

Residents of WAMay 5, 2021

Washington AG126,193 people

Residents of ORMay 5, 2021

Oregon DOJ1,656,569 people

TotalMay 5, 2021

HHS archive2,600,000 people

Residents of DEMay 28, 2021

Delaware DOJ130 people

Residents of CAJun 11, 2021

California AGCount not stated

History of this record

data_types2026-09-25

["names"] to ["names","health"]by backfillSource

records_basis2026-09-25

organization to hhsby backfillSource

records2026-09-25

2154280 to 2600000by backfillSource

summary2026-09-25

empty to The business associate (BA), NEC Networks dba CaptureRx, reported that it was the victim of a ransomware attack affecting the protected health information (PHI) of approximately 2,600,000 individuals. The PHI involved included names, dates by backfillSource

data_types2026-09-25

[] to ["names"]by backfillSource

records_basis2026-09-25

empty to organizationby backfillSource

records2026-09-25

empty to 2154280by backfillSource

attack2026-09-25

unknown to hackingby backfillSource

disclosed2026-09-25

2021-06-11 to 2021-05-05by backfillSource

discovered2026-09-25

empty to 2021-02-19by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about NEC Networks