Smith, Gambrell & Russell

Disclosed Jun 28, 20226,515 affectedConfirmed

The business associate (BA), Smith, Gambrell & Russell, LLP, reported that it experienced a hacking incident that affected the protected health information (PHI) of 4,688 individuals. The PHI involved included demographic, clinical, and financial information. The BA notified HHS, affected individuals, the media, and provided substitute notice. In response to the breach, the BA implemented additional administrative, technical, and security safeguards.

What is known

People affected	6,515 (as reported by the organization)
Disclosed	Jun 28, 2022
Discovered	Aug 9, 2021
Happened	Aug 9, 2021
Attack	Hacking
Data exposed	NamesHealth
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Smith, Gambrell & Russell

Official noticeatg.wa.gov

Washington Attorney General breach notice: Smith, Gambrell, & Russell

Official noticejustice.oregon.gov

Oregon DOJ breach notice: SMITH, GAMBRELL & RUSSELL

Official noticeago.vermont.gov

Vermont Attorney General: 2023-01-27 Smith Gambrell & Russell Data Breach Notice to Consumers

Official noticein.gov

Indiana Attorney General 2022 data breach report: Smith, Gambrell & Russell

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): Smith, Gambrell & Russell (Business Associate, GA)

Notices filed

Residents of INJun 28, 2022

Indiana AG1,558 people

Residents of CAAug 8, 2022

California AGCount not stated

TotalSep 28, 2022

HHS archive4,688 people

Residents of WADec 13, 2022

Washington AG545 people

Residents of ORJan 11, 2023

Oregon DOJCount not stated

Residents of VTJan 27, 2023

Vermont AGCount not stated

Residents of CAMar 1, 2023

California AGCount not stated

Other breaches at Smith, Gambrell & Russell

Hacking breachHacking exposed names and health records. Reported to the HHS archive.220K affectedHealthcareUSJul 9, 2024

History of this record

sector2026-09-25

other to healthby backfillSource

data_types2026-09-25

[] to ["names","health"]by backfillSource

summary2026-09-25

empty to The business associate (BA), Smith, Gambrell & Russell, LLP, reported that it experienced a hacking incident that affected the protected health information (PHI) of 4,688 individuals. The PHI involved included demographic, clinical, and finby backfillSource

records_basis2026-09-25

empty to organizationby backfillSource

records2026-09-25

empty to 6515by backfillSource

disclosed2026-09-25

2022-08-08 to 2022-06-28by backfillSource

source2026-09-25

empty to https://ago.vermont.gov/document/2023-01-27-smith-gambrell-russell-data-breach-notice-consumersby backfillSource

attack2026-09-25

unknown to hackingby backfillSource

discovered2026-09-25

empty to 2021-08-09by backfillSource

disclosed2026-09-25

2023-03-01 to 2022-08-08by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Smith, Gambrell & Russell