Gryphon Healthcare 2024 Data Breach

A California filing gives July 6, 2024 as the known breach date. Gryphon learned of the event on August 13, completed its file review on September 3, and mailed notices on October 11.

The organization said current and former patients may have been affected and that fields varied by person. Possible information included names, dates of birth, addresses, Social security numbers, dates of service, diagnoses, health insurance, treatment, prescriptions, providers, and medical record numbers. “Protected health information” and generic “medical information” are not additional populations beyond the underlying fields.

The company notice does not publish a count; later legal and reporting material describes approximately 393,358 potentially affected individuals. This is a notification population, not accounts, emails, dataset rows, or confirmed victims. Gryphon said it had no evidence of misuse as of the notice; that does not make later misuse impossible.

There is no local person-level or PHI dataset. The event does not identify anyone as a current patient, holder of a particular diagnosis, treatment, or prescription, insured person, or recipient of a particular provider's services. Social Security and healthcare associations must remain private, and direct recipients should review credit or healthcare and insurance records only as relevant to the fields in their own letters.