Westat

Disclosed Jul 21, 202351,513 affectedConfirmed

The covered entity (CE), Westat, reported that a software application used by its business associate (BA) exposed the protected health information (PHI) of 20,045 individuals. The PHI involved included names, addresses, dates of birth, claims information, diagnoses/conditions, and treatment information. The BA notified HHS, the affected individuals, and provided substitute notice. In response to the breach, the BA provided complimentary credit monitoring services and implemented additional administrative, technical, and security safeguards to better protect PHI.

What is known

People affected	51,513 (as reported to HHS)
Disclosed	Jul 21, 2023
Happened	May 28, 2023
Attack	Hacking
Data exposed	NamesHealth
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticeago.vermont.gov

Vermont Attorney General: 2023-07-21 Westat Data Breach Notice to Consumers

Official noticein.gov

Indiana Attorney General 2023 data breach report: Westat

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): Westat (Business Associate, MD)

Notices filed

Residents of VTJul 21, 2023

Vermont AGCount not stated

Residents of INJul 21, 2023

Indiana AG91 people

Residents of INOct 13, 2023

Indiana AG32 people

TotalOct 13, 2023

HHS archive51,513 people

TotalNov 3, 2023

HHS archive20,045 people

History of this record

records2026-09-25

20045 to 51513by backfillSource

sector2026-09-25

other to healthby backfillSource

attack2026-09-25

unknown to hackingby backfillSource

data_types2026-09-25

[] to ["names","health"]by backfillSource

records_basis2026-09-25

organization to hhsby backfillSource

records2026-09-25

7954 to 20045by backfillSource

summary2026-09-25

empty to The covered entity (CE), Westat, reported that a software application used by its business associate (BA) exposed the protected health information (PHI) of 20,045 individuals. The PHI involved included names, addresses, dates of birth, claiby backfillSource

records_basis2026-09-25

empty to organizationby backfillSource

records2026-09-25

empty to 7954by backfillSource

occurred2026-09-25

empty to 2023-05-28by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (Vermont AG), confirmed by Vermont AG. Record counts are as reported. Not legal advice.

Everything about Westat