Skip to content

Walmart

Disclosed Feb 23, 20242 years ago1,267 affectedConfirmed

Official notice

Walmart, the covered entity (CE) reported that a technical error made by an employee allowed the protected health information (PHI) of 1,267 individuals to be viewable via the Internet by others. The PHI involved included names, dates of birth, and gender. The CE notified HHS, affected individuals, and the media. In response to the breach and OCR’s investigation, the CE implemented additional technical safeguards and retrained its workforce members.

What is known

People affected1,267 (as reported to HHS)
DisclosedFeb 23, 2024
HappenedDec 3, 2023
AttackInsider
Data exposedNames, Health
SectorHealthcare · US
StatusConfirmed

Sources

Source
Indiana Attorney General 2024 data breach report: Walmartin.gov · Official notice
HHS OCR breach report (archive, resolved): Walmart (Healthcare Provider, AR)ocrportal.hhs.gov · Official notice

Notices filed

WhereFiledPeople
Indiana AGresidents of INFeb 23, 20244
HHS archivetotalJun 14, 20241,267

Other breaches at Walmart

BreachAffected
Disclosed Jul 26, 2019Jul 26, 20197 years agoLost or stolen device15K
Disclosed Feb 22, 2018Feb 22, 20188 years agoInsider741
History of this record
  • 2026-09-25 · sector: other to health · backfill source
  • 2026-09-25 · attack: unknown to insider · backfill source
  • 2026-09-25 · data_types: [] to ["names","health"] · backfill source
  • 2026-09-25 · records_basis: organization to hhs · backfill source
  • 2026-09-25 · records: 204 to 1267 · backfill source
  • 2026-09-25 · summary: empty to Walmart, the covered entity (CE) reported that a technical error made by an employee allowed the protected health information (PHI) of 1,267 individuals to be viewable via the Internet by others. The PHI involved included names, dates of bi · backfill source
  • 2026-09-25 · added · backfill source

First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.

Everything about Walmart

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.