Smile Brands
Disclosed Jun 24, 20215 years ago2,592,494 affectedConfirmed
The business associate (BA), Smile Brands, reported that it experienced a ransomware incident that affected the protected health information (PHI) of 2,592,494 individuals. The PHI involved included names, dates of birth, addresses, Social Security numbers, diagnoses, and lab results. The BA notified HHS, affected individuals, the media, and provided substitute notice. In response to the breach, the BA offered free credit monitoring services and implemented additional technical and administrative safeguards to better protect sensitive data.
What is known
| People affected | 2,592,494 (as reported to HHS) |
|---|---|
| Disclosed | Jun 24, 2021 |
| Discovered | Apr 24, 2021 |
| Happened | Apr 23, 2021 |
| Attack | Ransomware |
| Data exposed | Names, Health |
| Sector | Retail · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Smile Brandsoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Smile Brandsatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Smile Brandsjustice.oregon.gov · Official notice | Official notice |
| Indiana Attorney General 2021 data breach report: Smile Brandsin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Smile Brands (Business Associate, CA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Jun 24, 2021 | 2,592,494 |
| Indiana AGresidents of IN | Aug 9, 2021 | 420 |
| California AGresidents of CA | Sep 3, 2021 | |
| Washington AGresidents of WA | Oct 8, 2021 | 108,927 |
| Oregon DOJresidents of OR | Oct 8, 2021 |
History of this record
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 2592494 · backfill source
- 2026-09-25 · disclosed: 2021-08-09 to 2021-06-24 · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), Smile Brands, reported that it experienced a ransomware incident that affected the protected health information (PHI) of 2,592,494 individuals. The PHI involved included names, dates of birth, addresses, Social · backfill source
- 2026-09-25 · disclosed: 2021-09-03 to 2021-08-09 · backfill source
- 2026-09-25 · attack: unknown to ransomware · backfill source
- 2026-09-25 · discovered: empty to 2021-04-24 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.