SAG-AFTRA Health Plan
Disclosed Dec 2, 20241 year ago98,474 affectedConfirmed
The covered entity (CE), SAG-AFTRA Health Plan, reported that an employee was the target of an email phishing scheme that affected the electronic protected health information (ePHI) of 98,474 individuals. The ePHI involved included names, social security numbers, and claims information. The CE notified HHS, affected individuals, and the media. In response to the breach, the CE implemented additional administrative, technical, and security safeguards. Staff were also retrained in its requirements to protect and secure PHI. OCR provided technical assistance to the CE regarding the HIPAA Security Rule.
What is known
| People affected | 98,474 (as reported to HHS) |
|---|---|
| Disclosed | Dec 2, 2024 |
| Discovered | Sep 18, 2024 |
| Happened | Sep 17, 2024 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: SAG-AFTRA Health Planoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: SAG-AFTRA Health Planatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: SAG-AFTRA Health Planjustice.oregon.gov · Official notice | Official notice |
| Vermont Attorney General: 2025-03-14 SAG-AFTRA Health Plan Data breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Vermont Attorney General: 2024-12 02 SAG-AFTRA Health Plan Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): SAG-AFTRA Health Plan (Health Plan, CA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Dec 2, 2024 | |
| Vermont AGresidents of VT | Dec 2, 2024 | |
| HHS archivetotal | Dec 2, 2024 | 98,474 |
| California AGresidents of CA | Mar 14, 2025 | |
| Washington AGresidents of WA | Mar 14, 2025 | 937 |
| Oregon DOJresidents of OR | Mar 14, 2025 | 95,104 |
| Vermont AGresidents of VT | Mar 14, 2025 |
History of this record
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 98474 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), SAG-AFTRA Health Plan, reported that an employee was the target of an email phishing scheme that affected the electronic protected health information (ePHI) of 98,474 individuals. The ePHI involved included names, s · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2024-12-02-sag-aftra-health-plan-data-breach-notice-consumers · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2025-03-14-sag-aftra-health-plan-data-breach-notice-consumers · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2024-09-18 · backfill source
- 2026-09-25 · disclosed: 2025-03-14 to 2024-12-02 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.