Skip to content

Walmart

Disclosed Jul 26, 20197 years ago14,532 affectedConfirmed

Official notice

The covered entity (CE), Walmart, reported that a laptop containing the protected health information (PHI) of 828 individuals was lost. The PHI involved included names, dates of birth, and other treatment information. The CE notified HHS, affected individuals, and the media. In response to the breach, the CE strengthened its physical security measures and retrained its workforce members on policies and procedures to safeguard PHI.

What is known

People affected14,532 (as reported to HHS)
DisclosedJul 26, 2019
DiscoveredFeb 16, 2021
HappenedJan 20, 2021
AttackLost or stolen device
Data exposedNames, Health
SectorHealthcare · US
StatusConfirmed

Sources

Source
Notice letter filed with the Delaware DOJ: Walmartattorneygeneral.delaware.gov · Official notice
HHS OCR breach report (archive, resolved): Walmart (Healthcare Provider, AR)ocrportal.hhs.gov · Official notice

Notices filed

WhereFiledPeople
HHS archivetotalJul 26, 20193,135
HHS archivetotalAug 9, 20194,738
HHS archivetotalOct 17, 20194,211
HHS archivetotalFeb 12, 20203,606
HHS archivetotalNov 20, 2020524
Delaware DOJresidents of DEMar 5, 2021799
HHS archivetotalMar 5, 20212,071
HHS archivetotalJun 18, 202114,532
HHS archivetotalOct 26, 2021828

Other breaches at Walmart

BreachAffected
Disclosed Feb 23, 2024Feb 23, 20242 years agoInsider1,267
Disclosed Feb 22, 2018Feb 22, 20188 years agoInsider741
History of this record
  • 2026-09-25 · disclosed: 2019-08-09 to 2019-07-26 · backfill source
  • 2026-09-25 · disclosed: 2019-10-17 to 2019-08-09 · backfill source
  • 2026-09-25 · disclosed: 2020-02-12 to 2019-10-17 · backfill source
  • 2026-09-25 · disclosed: 2020-11-20 to 2020-02-12 · backfill source
  • 2026-09-25 · disclosed: 2021-03-05 to 2020-11-20 · backfill source
  • 2026-09-25 · records_basis: organization to hhs · backfill source
  • 2026-09-25 · records: 2067 to 14532 · backfill source
  • 2026-09-25 · sector: other to health · backfill source
  • 2026-09-25 · attack: unknown to lost-device · backfill source
  • 2026-09-25 · summary: empty to The covered entity (CE), Walmart, reported that a laptop containing the protected health information (PHI) of 828 individuals was lost. The PHI involved included names, dates of birth, and other treatment information. The CE notified HHS, a · backfill source
  • 2026-09-25 · added · backfill source

First seen 2026-09-25 (Delaware DOJ), confirmed by Delaware DOJ. Record counts are as reported. Not legal advice.

Everything about Walmart

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.