Tarleton Medical
Disclosed Mar 6, 20179 years ago3,929 affectedConfirmed
The covered entity (CE) was the victim of a malware/ransom attack. The electronic protected health information (ePHI) involved in the breach included the names, dates of birth, addresses, social security numbers, and health care claims information of of 3,929 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE strengthened its administrative and technical safeguards by implementing a stronger password policy encrypting all its computers, and enhancing firewall and antivirus protection for its electronic systems. OCR’s investigation resulted in the CE enhancing its safeguards for ePHI.
What is known
| People affected | 3,929 (as reported to HHS) |
|---|---|
| Disclosed | Mar 6, 2017 |
| Happened | Jan 6, 2017 |
| Attack | Hacking |
| Data exposed | Names, Social Security numbers, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Tarleton Medicaloag.ca.gov · Official notice | Official notice |
| Maine Attorney General breach notice archive: Tarleton Medicalmaine.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Tarleton Medical (Healthcare Provider, CA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Mar 6, 2017 | 3,929 |
| Maine AGresidents of ME | Mar 8, 2017 | 2 |
| California AGresidents of CA | Mar 9, 2017 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: ["names","ssn"] to ["names","ssn","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 3929 · backfill source
- 2026-09-25 · disclosed: 2017-03-08 to 2017-03-06 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE) was the victim of a malware/ransom attack. The electronic protected health information (ePHI) involved in the breach included the names, dates of birth, addresses, social security numbers, and health care claims info · backfill source
- 2026-09-25 · data_types: [] to ["names","ssn"] · backfill source
- 2026-09-25 · disclosed: 2017-03-09 to 2017-03-08 · backfill source
- 2026-09-25 · occurred: empty to 2017-01-06 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.