Ravkoo
Disclosed Jan 3, 20224 years ago105,000 affectedConfirmed
Ravkoo reported that its prescription portal was the target of a cybersecurity attack potentially exposing the protected health information (PHI) of 105,000 individuals. The PHI involved included names, telephone numbers, and prescription medication information. At the time of the incident, Ravkoo met the definition of a covered entity under HIPAA; however, during OCR’s investigation, Ravkoo permanently closed all of its locations, and ceased operations. Therefore the investigation was terminated and the case closed.
What is known
| People affected | 105,000 (as reported by the organization) |
|---|---|
| Disclosed | Jan 3, 2022 |
| Discovered | Sep 27, 2021 |
| Happened | Sep 27, 2021 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Ravkoooag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Ravkooatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Ravkoojustice.oregon.gov · Official notice | Official notice |
| Indiana Attorney General 2022 data breach report: Ravkooin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Ravkoo (Healthcare Provider, FL)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Jan 3, 2022 | |
| Washington AGresidents of WA | Jan 3, 2022 | 5,729 |
| Indiana AGresidents of IN | Jan 3, 2022 | 1,437 |
| HHS archivetotal | Jan 3, 2022 | 105,000 |
| Oregon DOJresidents of OR | Jan 5, 2022 | 105,000 |
History of this record
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to Ravkoo reported that its prescription portal was the target of a cybersecurity attack potentially exposing the protected health information (PHI) of 105,000 individuals. The PHI involved included names, telephone numbers, and prescription m · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 105000 · backfill source
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2021-09-27 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.