Osborn Cancer Care
Disclosed May 28, 20215 years ago4,614 affectedConfirmed
The covered entity (CE), Osborn Cancer Care, reported that its business associate (BA) was the subject of a ransomware attack affecting the protected health information (PHI) of 4,614 individuals. The PHI involved included names, dates of birth, drivers’ license information, addresses, diagnoses, lab results, medications prescribed, and other treatment information. The CE notified HHS, affected individuals, and the media. In response to the breach, the CE provided complimentary credit monitoring services to those affected. OCR provided technical assistance regarding the HIPAA Rules.
What is known
| People affected | 4,614 (as reported to HHS) |
|---|---|
| Disclosed | May 28, 2021 |
| Discovered | Feb 17, 2021 |
| Happened | Feb 10, 2021 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Washington Attorney General breach notice: Osborn Cancer Careatg.wa.gov · Official notice | Official notice |
| Indiana Attorney General 2021 data breach report: Osborn Cancer Carein.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Osborn Cancer Care (Healthcare Provider, WA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Washington AGresidents of WA | May 28, 2021 | 4,305 |
| HHS archivetotal | Jul 8, 2021 | 4,614 |
| Indiana AGresidents of IN | Jul 26, 2021 | 1 |
History of this record
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 4424 to 4614 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Osborn Cancer Care, reported that its business associate (BA) was the subject of a ransomware attack affecting the protected health information (PHI) of 4,614 individuals. The PHI involved included names, dates of b · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 4424 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Washington AG), confirmed by Washington AG. Record counts are as reported. Not legal advice.