TGI Direct

Disclosed Nov 21, 202316,113 affectedConfirmed

The business associate, TGI Direct, reported that a software application exposed the protected health information (PHI) of 11,556 individuals. The PHI involved included names, dates of birth, addresses, and diagnoses. The BA notified HHS, the affected individuals, the media, and provided substitute notice. In response to the breach, the BA provided complimentary credit monitoring services and implemented additional administrative, technical, and security safeguards to better protect PHI.

What is known

People affected	16,113 (as reported to HHS)
Disclosed	Nov 21, 2023
Discovered	May 28, 2023
Happened	May 28, 2023
Attack	Ransomware
Data exposed	NamesHealth
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticeatg.wa.gov

Washington Attorney General breach notice: TGI Direct

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): TGI Direct (Business Associate, MI)

Notices filed

TotalNov 21, 2023

HHS archive16,113 people

Residents of WAJan 17, 2024

Washington AG3,428 people

TotalJan 17, 2024

HHS archive11,556 people

History of this record

records2026-09-25

11556 to 16113by backfillSource

disclosed2026-09-25

2024-01-17 to 2023-11-21by backfillSource

sector2026-09-25

other to healthby backfillSource

data_types2026-09-25

[] to ["names","health"]by backfillSource

records_basis2026-09-25

empty to hhsby backfillSource

records2026-09-25

empty to 11556by backfillSource

summary2026-09-25

empty to The business associate, TGI Direct, reported that a software application exposed the protected health information (PHI) of 11,556 individuals. The PHI involved included names, dates of birth, addresses, and diagnoses. The BA notified HHS, tby backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (Washington AG), confirmed by Washington AG. Record counts are as reported. Not legal advice.

Everything about TGI Direct