United Steelworkers Local 286
Disclosed Apr 14, 20233 years ago49,019 affectedConfirmed
United Steelworkers Local 286, the covered entity (CE), reported that an employee was the subject of an email phishing scheme that compromised the protected health information (PHI) of 37,965 individuals. The PHI involved included names, Social Security numbers, dates of birth, drivers’ license and/or state identification numbers, passport numbers, and health insurance and other treatment information. In its mitigation efforts, the CE implemented additional administrative, technical, and security safeguards. Staff were retrained on email security.
What is known
| People affected | 49,019 (as reported by the organization) |
|---|---|
| Disclosed | Apr 14, 2023 |
| Happened | Jun 16, 2022 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Insurance · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Vermont Attorney General: 2023-04-14 United Steelworkers Local 286 Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Indiana Attorney General 2023 data breach report: United Steelworkers Local 286in.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): United Steelworkers Local 286 (Health Plan, PA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Vermont AGresidents of VT | Apr 14, 2023 | |
| Indiana AGresidents of IN | Apr 14, 2023 | 39 |
| HHS archivetotal | Apr 14, 2023 | 37,965 |
History of this record
- 2026-09-25 · sector: other to insurance · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to United Steelworkers Local 286, the covered entity (CE), reported that an employee was the subject of an email phishing scheme that compromised the protected health information (PHI) of 37,965 individuals. The PHI involved included names, So · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 49019 · backfill source
- 2026-09-25 · occurred: empty to 2022-06-16 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Vermont AG), confirmed by Vermont AG. Record counts are as reported. Not legal advice.