Stanford University School of Medicine
Disclosed May 28, 20215 years ago2,063 affectedConfirmed
The covered entity (CE), Stanford University School of Medicine, reported that its business associate (BA) experienced a cyber-attack that affected the electronic protected health information (ePHI) of 2,063 individuals. The ePHI involved included names, addresses, email addresses, dates of birth, Social Security numbers, and diagnoses. The CE notified HHS and affected individuals. Following the breach, the CE offered complimentary identity protection and credit monitoring services.
What is known
| People affected | 2,063 (as reported to HHS) |
|---|---|
| Disclosed | May 28, 2021 |
| Happened | Jan 21, 2021 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Indiana Attorney General 2021 data breach report: Stanford University School of Medicinein.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Stanford University School of Medicine (Healthcare Provider, CA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | May 28, 2021 | 15 |
| HHS archivetotal | May 28, 2021 | 2,063 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 2063 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Stanford University School of Medicine, reported that its business associate (BA) experienced a cyber-attack that affected the electronic protected health information (ePHI) of 2,063 individuals. The ePHI involved i · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.