UNITE HERE
Disclosed Feb 23, 20233 years ago791,273 affectedConfirmed
The business associate (BA), Unite Here, reported that it experienced a cybersecurity incident that affected the protected health information (PHI) of 95,797 individuals. The PHI involved included demographic information. The BA notified HHS, the affected individuals, the media, and provided substitute notice. In response to the breach, the BA provided complimentary credit monitoring services to the affected individuals and implemented additional administrative, technical, and security safeguards to better protect PHI.
What is known
| People affected | 791,273 (as reported by the organization) |
|---|---|
| Disclosed | Feb 23, 2023 |
| Discovered | Oct 20, 2023 |
| Happened | Oct 20, 2023 |
| Attack | Ransomware |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: UNITE HEREoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: UNITE HEREatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: UNITE HEREjustice.oregon.gov · Official notice | Official notice |
| Vermont Attorney General: 2023-02-23 UNITE HERE Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Indiana Attorney General 2024 data breach report: UNITE HEREin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): UNITE HERE (Business Associate, NY)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Vermont AGresidents of VT | Feb 23, 2023 | |
| California AGresidents of CA | Feb 23, 2024 | |
| Washington AGresidents of WA | Feb 23, 2024 | 76,574 |
| Oregon DOJresidents of OR | Feb 23, 2024 | 791,273 |
| Indiana AGresidents of IN | Feb 23, 2024 | 5,681 |
| HHS archivetotal | Feb 23, 2024 | 95,797 |
History of this record
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), Unite Here, reported that it experienced a cybersecurity incident that affected the protected health information (PHI) of 95,797 individuals. The PHI involved included demographic information. The BA notified HH · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 791273 · backfill source
- 2026-09-25 · disclosed: 2024-02-23 to 2023-02-23 · backfill source
- 2026-09-25 · attack: unknown to ransomware · backfill source
- 2026-09-25 · discovered: empty to 2023-10-20 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.