Sound Generations
Disclosed Nov 29, 20214 years ago600,605 affectedConfirmed
The business associate (BA), Sound Generations, reported that it was the victim of a ransomware attack affecting the protected health information (PHI) of 103,576 individuals. The PHI involved included names, addresses, phone numbers, email addresses, dates of birth, health insurance information, and other treatment information. The BA notified HHS, affected individuals, the media, and provided substitute notice. In response to the breach, the BA implemented additional administrative, technical, and security safeguards and retrained its staff.
What is known
| People affected | 600,605 (as reported by the organization) |
|---|---|
| Disclosed | Nov 29, 2021 |
| Discovered | Jul 18, 2021 |
| Happened | Jul 18, 2021 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Sound Generationsoag.ca.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Sound Generationsjustice.oregon.gov · Official notice | Official notice |
| Indiana Attorney General 2021 data breach report: Sound Generationsin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Sound Generations (Business Associate, WA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Nov 29, 2021 | 456,243 |
| Oregon DOJresidents of OR | Dec 13, 2021 | 600,605 |
| Indiana AGresidents of IN | Dec 13, 2021 | 2,135 |
| California AGresidents of CA | Dec 15, 2021 |
History of this record
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · disclosed: 2021-12-13 to 2021-11-29 · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), Sound Generations, reported that it was the victim of a ransomware attack affecting the protected health information (PHI) of 103,576 individuals. The PHI involved included names, addresses, phone numbers, email · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 600605 · backfill source
- 2026-09-25 · disclosed: 2021-12-15 to 2021-12-13 · backfill source
- 2026-09-25 · discovered: empty to 2021-07-18 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.