Tosoh America

Disclosed Jun 17, 2022880 affectedConfirmed

Tosoh America, the covered entity (CE), reported that multiple employees were the subjects of an email phishing scheme that compromised the protected health information (PHI) of 880 individuals. The PHI involved included names, dates of birth, and Social Security numbers. The CE notified HHS and the affected individuals. In its mitigation efforts, the CE provided complimentary credit monitoring services and implemented additional administrative, technical, and security safeguards. Staff were retrained on email security precautions. OCR provided technical assistance regarding the HIPAA Rules.

What is known

People affected	880 (as reported to HHS)
Disclosed	Jun 17, 2022
Discovered	Apr 18, 2022
Happened	Apr 18, 2022
Attack	Hacking
Data exposed	NamesHealth
Sector	Insurance · US
Status	Confirmed

Sources

Official noticejustice.oregon.gov

Oregon DOJ breach notice: Tosoh America

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): Tosoh America (Health Plan, OH)

Notices filed

Residents of ORJun 17, 2022

Oregon DOJ880 people

TotalJun 17, 2022

HHS archive880 people

History of this record

sector2026-09-25

other to insuranceby backfillSource

attack2026-09-25

unknown to hackingby backfillSource

data_types2026-09-25

[] to ["names","health"]by backfillSource

records_basis2026-09-25

empty to hhsby backfillSource

records2026-09-25

empty to 880by backfillSource

summary2026-09-25

empty to Tosoh America, the covered entity (CE), reported that multiple employees were the subjects of an email phishing scheme that compromised the protected health information (PHI) of 880 individuals. The PHI involved included names, dates of birby backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (Oregon DOJ), confirmed by Oregon DOJ. Record counts are as reported. Not legal advice.

Everything about Tosoh America