Therapeutic Health Services
Disclosed Apr 25, 20242 years ago27,170 affectedConfirmed
The covered entity (CE), Therapeutic Health Services, reported that it experienced a ransomware incident that affected the electronic protected health information (ePHI) of 27,170 individuals. The ePHI involved included names, dates of birth, Social Security numbers, addresses/zip codes, driver’s license numbers, credit card/bank account numbers, diagnoses and conditions, lab results, medications, and other treatment information. The CE notified HHS, affected individuals, and the media. In response to the breach, the CE implemented additional administrative, technical, and security safeguards. Staff were also retrained in its requirements to protect and secure PHI. OCR provided technical assistance to the CE.
What is known
| People affected | 27,170 (as reported to HHS) |
|---|---|
| Disclosed | Apr 25, 2024 |
| Discovered | Feb 26, 2024 |
| Happened | Feb 24, 2024 |
| Attack | Ransomware |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Therapeutic Health Servicesoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Therapeutic Health Servicesatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Therapeutic Health Servicesjustice.oregon.gov · Official notice | Official notice |
| Vermont Attorney General: 2024-07-18 Therapeutic Health Services Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Indiana Attorney General 2024 data breach report: Therapeutic Health Servicesin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Therapeutic Health Services (Healthcare Provider, WA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Apr 25, 2024 | 27,170 |
| Washington AGresidents of WA | Jul 11, 2024 | 24,281 |
| Vermont AGresidents of VT | Jul 18, 2024 | |
| California AGresidents of CA | Jul 19, 2024 | |
| Indiana AGresidents of IN | Jul 19, 2024 | 36 |
| Oregon DOJresidents of OR | Oct 31, 2024 | 27,170 |
History of this record
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 14164 to 27170 · backfill source
- 2026-09-25 · disclosed: 2024-07-11 to 2024-04-25 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Therapeutic Health Services, reported that it experienced a ransomware incident that affected the electronic protected health information (ePHI) of 27,170 individuals. The ePHI involved included names, dates of birt · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 14164 · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2024-07-18-therapeutic-health-services-data-breach-notice-consumers · backfill source
- 2026-09-25 · attack: unknown to ransomware · backfill source
- 2026-09-25 · disclosed: 2024-07-19 to 2024-07-11 · backfill source
- 2026-09-25 · discovered: empty to 2024-02-26 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.