Postmeds
Disclosed Oct 30, 20232 years ago2,369,026 affectedConfirmed
The covered entity (CE), Postmeds, Inc., reported that its business associate (BA) experienced a cybersecurity incident that affected the protected health information (PHI) of 2,369,026 individuals. The PHI involved included names, dates of birth, medications, and some Social Security numbers. The CE notified HHS, the affected individuals, the media, and provided substitute notice on its website. OCR provided the CE with technical assistance regarding the HIPAA Rules.
What is known
| People affected | 2,369,026 (as reported to HHS) |
|---|---|
| Disclosed | Oct 30, 2023 |
| Discovered | Aug 31, 2023 |
| Happened | Aug 30, 2023 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Postmedsoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Postmedsatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Postmedsjustice.oregon.gov · Official notice | Official notice |
| Vermont Attorney General: 2024-01-17 Postmeds Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Postmeds (Healthcare Provider, CA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Oct 30, 2023 | |
| Washington AGresidents of WA | Oct 30, 2023 | 48,861 |
| Oregon DOJresidents of OR | Oct 30, 2023 | |
| HHS archivetotal | Oct 30, 2023 | 2,369,026 |
| Vermont AGresidents of VT | Jan 17, 2024 |
History of this record
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 2369026 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Postmeds, Inc., reported that its business associate (BA) experienced a cybersecurity incident that affected the protected health information (PHI) of 2,369,026 individuals. The PHI involved included names, dates of · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2024-01-17-postmeds-data-breach-notice-consumers · backfill source
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2023-08-31 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.