Thompson Coburn
Disclosed Nov 4, 20241 year ago305,088 affectedConfirmed
Thompson Coburn LLP, the business associate (BA), reported that it experienced a ransomware attack affecting the electronic protected health information (ePHI) of 305,088 individuals. The ePHI involved included demographic, clinical, and financial information. The BA notified HHS, affected individuals, and the media. The BA took several corrective actions in response to the breach including improving its cybersecurity and providing additional HIPAA training to its workforce members.
What is known
| People affected | 305,088 (as reported to HHS) |
|---|---|
| Disclosed | Nov 4, 2024 |
| Happened | May 28, 2024 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Thompson Coburnoag.ca.gov · Official notice | Official notice |
| Vermont Attorney General: 2025-04-30 Thompson Coburn Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Vermont Attorney General: 2024-12-31 Thompson Coburn Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Indiana Attorney General 2025 data breach report: Thompson Coburnin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Thompson Coburn (Business Associate, MO)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Nov 4, 2024 | 305,088 |
| Vermont AGresidents of VT | Dec 31, 2024 | |
| California AGresidents of CA | Apr 30, 2025 | |
| Vermont AGresidents of VT | Apr 30, 2025 | |
| Indiana AGresidents of IN | Apr 30, 2025 | 1,557 |
History of this record
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 67026 to 305088 · backfill source
- 2026-09-25 · disclosed: 2024-12-31 to 2024-11-04 · backfill source
- 2026-09-25 · summary: empty to Thompson Coburn LLP, the business associate (BA), reported that it experienced a ransomware attack affecting the electronic protected health information (ePHI) of 305,088 individuals. The ePHI involved included demographic, clinical, and fi · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 67026 · backfill source
- 2026-09-25 · disclosed: 2025-04-30 to 2024-12-31 · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2025-04-30-thompson-coburn-data-breach-notice-consumers · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.