Tosoh America
Disclosed Jun 17, 20224 years ago880 affectedConfirmed
Tosoh America, the covered entity (CE), reported that multiple employees were the subjects of an email phishing scheme that compromised the protected health information (PHI) of 880 individuals. The PHI involved included names, dates of birth, and Social Security numbers. The CE notified HHS and the affected individuals. In its mitigation efforts, the CE provided complimentary credit monitoring services and implemented additional administrative, technical, and security safeguards. Staff were retrained on email security precautions. OCR provided technical assistance regarding the HIPAA Rules.
What is known
| People affected | 880 (as reported to HHS) |
|---|---|
| Disclosed | Jun 17, 2022 |
| Discovered | Apr 18, 2022 |
| Happened | Apr 18, 2022 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Insurance · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Oregon DOJ breach notice: Tosoh Americajustice.oregon.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Tosoh America (Health Plan, OH)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Oregon DOJresidents of OR | Jun 17, 2022 | 880 |
| HHS archivetotal | Jun 17, 2022 | 880 |
History of this record
- 2026-09-25 · sector: other to insurance · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 880 · backfill source
- 2026-09-25 · summary: empty to Tosoh America, the covered entity (CE), reported that multiple employees were the subjects of an email phishing scheme that compromised the protected health information (PHI) of 880 individuals. The PHI involved included names, dates of bir · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Oregon DOJ), confirmed by Oregon DOJ. Record counts are as reported. Not legal advice.