Sovos Compliance
Disclosed Jul 12, 20233 years ago215,114 affectedConfirmed
The covered entity (CE), Sovos Compliance, reported that a vulnerability was detected in its business associate’s (BA) software application that impacted the protected health information (PHI) of 18,261 individuals. The PHI involved included names, Social Security numbers, addresses, dates of birth, email addresses, and financial and claims information. The CE notified HHS, affected individuals, the media, and posted substitute notice. In response to the breach, the CE provided complimentary credit monitoring services and the CE and BA implemented additional administrative, technical, and security safeguards to better protect PHI.
What is known
| People affected | 215,114 (as reported by the organization) |
|---|---|
| Disclosed | Jul 12, 2023 |
| Discovered | Jun 12, 2023 |
| Happened | May 27, 2023 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Finance · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Sovos Complianceoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Sovos Complianceatg.wa.gov · Official notice | Official notice |
| Notice letter filed with the Delaware DOJ: Sovos Complianceattorneygeneral.delaware.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Sovos Compliancejustice.oregon.gov · Official notice | Official notice |
| Vermont Attorney General: 2023-07-12 Sovos Compliance Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Indiana Attorney General 2023 data breach report: Sovos Compliancein.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Sovos Compliance (Business Associate, MA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Delaware DOJresidents of DE | Jul 12, 2023 | 163 |
| Vermont AGresidents of VT | Jul 12, 2023 | |
| Indiana AGresidents of IN | Jul 12, 2023 | 1,421 |
| California AGresidents of CA | Jul 13, 2023 | |
| HHS archivetotal | Aug 8, 2023 | 18,261 |
| California AGresidents of CA | Aug 23, 2023 | |
| Washington AGresidents of WA | Aug 23, 2023 | 11,103 |
| Oregon DOJresidents of OR | Aug 23, 2023 | 215,114 |
| California AGresidents of CA | Sep 22, 2023 | |
| Washington AGresidents of WA | Sep 22, 2023 | 1,450 |
| Oregon DOJresidents of OR | Sep 22, 2023 | 181,507 |
History of this record
- 2026-09-25 · data_types: ["names"] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Sovos Compliance, reported that a vulnerability was detected in its business associate’s (BA) software application that impacted the protected health information (PHI) of 18,261 individuals. The PHI involved include · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 215114 · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2023-07-12-sovos-compliance-data-breach-notice-consumers · backfill source
- 2026-09-25 · data_types: [] to ["names"] · backfill source
- 2026-09-25 · disclosed: 2023-07-13 to 2023-07-12 · backfill source
- 2026-09-25 · sector: other to finance · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2023-06-12 · backfill source
- 2026-09-25 · disclosed: 2023-08-23 to 2023-07-13 · backfill source
- 2026-09-25 · disclosed: 2023-09-22 to 2023-08-23 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.