SEIU 775 Benefits Group
Disclosed May 5, 20215 years ago140,000 affectedConfirmed
The covered entity (CE), SEIU 775 Benefits Group, reported that it experienced a cyber-attack that compromised the protected health information (PHI) of 140,000 individuals. The PHI involved included names, addresses, and Social Security numbers. The CE notified HHS, affected individuals, the media, and provided substitute notice. Following the breach incident and OCR’s investigation, the CE implemented new administrative and technical safeguards.
What is known
| People affected | 140,000 (as reported by the organization) |
|---|---|
| Disclosed | May 5, 2021 |
| Discovered | Apr 4, 2021 |
| Happened | Apr 4, 2021 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Insurance · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: SEIU 775 Benefits Groupoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: SEIU 775 Benefits Groupatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: SEIU 775 Benefits Groupjustice.oregon.gov · Official notice | Official notice |
| Indiana Attorney General 2021 data breach report: SEIU 775 Benefits Groupin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): SEIU 775 Benefits Group (Business Associate, WA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Washington AGresidents of WA | May 5, 2021 | 124,760 |
| California AGresidents of CA | May 7, 2021 | |
| Oregon DOJresidents of OR | May 10, 2021 | 140,000 |
| Indiana AGresidents of IN | May 10, 2021 | 129 |
| HHS archivetotal | May 27, 2021 | 140,000 |
History of this record
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), SEIU 775 Benefits Group, reported that it experienced a cyber-attack that compromised the protected health information (PHI) of 140,000 individuals. The PHI involved included names, addresses, and Social Security nu · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 140000 · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · disclosed: 2021-05-07 to 2021-05-05 · backfill source
- 2026-09-25 · discovered: empty to 2021-04-04 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.