New Jersey Brain & Spine
Disclosed Mar 10, 20224 years ago92,453 affectedConfirmed
New Jersey Brain and Spine, the covered entity (CE), reported that it experienced a cyber-attack that compromised the protected health information (PHI) for 92,453 individuals. The PHI involved included names, addresses, dates of birth, drivers’ license and Social Security numbers, financial information, diagnoses/conditions, lab results, medications, and other treatment information. The CE notified HHS, affected individuals, the media, and posted substitute notice on its website. In its mitigation efforts, the CE installed a new server and implemented multi-factor authentication.
What is known
| People affected | 92,453 (as reported by the organization) |
|---|---|
| Disclosed | Mar 10, 2022 |
| Happened | Nov 12, 2021 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Indiana Attorney General 2022 data breach report: New Jersey Brain & Spinein.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): New Jersey Brain and Spine (Healthcare Provider, NJ)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Mar 10, 2022 | 92,453 |
| Indiana AGresidents of IN | Apr 8, 2022 | 8 |
History of this record
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · disclosed: 2022-04-08 to 2022-03-10 · backfill source
- 2026-09-25 · summary: empty to New Jersey Brain and Spine, the covered entity (CE), reported that it experienced a cyber-attack that compromised the protected health information (PHI) for 92,453 individuals. The PHI involved included names, addresses, dates of birth, dri · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.