Trillium Community Health Plan
Disclosed Mar 3, 20215 years ago87,761 affectedConfirmed
The covered entity (CE), Trillium Community Health Plan, reported that its business associate (BA) experienced a cyber-attack that affected the electronic protected health information (ePHI) of 87,761 individuals. The ePHI involved included names, addresses, dates of birth, health insurance information, diagnoses, medications prescribed, and other treatment information. The CE notified HHS, affected individuals, the media, and provided substitute notice. Following the breach, the CE provided complimentary identity protection services to affected individuals and terminated its contract with the BA.
What is known
| People affected | 87,761 (as reported to HHS) |
|---|---|
| Disclosed | Mar 3, 2021 |
| Discovered | Sep 17, 2021 |
| Happened | Mar 4, 2021 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Oregon DOJ breach notice: Trillium Community Health Planjustice.oregon.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Trillium Community Health Plan (Health Plan, OR)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Mar 3, 2021 | 87,761 |
| Oregon DOJresidents of OR | Mar 4, 2021 | 2,181 |
| Oregon DOJresidents of OR | Jan 7, 2022 | 7,958 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 87761 · backfill source
- 2026-09-25 · disclosed: 2021-03-04 to 2021-03-03 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Trillium Community Health Plan, reported that its business associate (BA) experienced a cyber-attack that affected the electronic protected health information (ePHI) of 87,761 individuals. The ePHI involved included · backfill source
- 2026-09-25 · disclosed: 2022-01-07 to 2021-03-04 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Oregon DOJ), confirmed by Oregon DOJ. Record counts are as reported. Not legal advice.