HealthEC 2023 Data Breach
The 2023 HealthEC data breach involved an unknown actor accessing certain systems and copying files between July 14 and July 23, 2023. HealthEC said it investigated, reviewed the files, and began notifying clients on October 26.
The affected total is not confirmed, so severity cannot be determined from a record count alone.
Exposed Data Types
8 sensitive13- Medical record numbers
- Diagnoses and medical information
- Prescription information
- Provider names
- Medicare and Medicaid identifiers
- Patient account and identification numbers
- Treatment cost information
- Health insurance information
- Names
- Physical addresses
- Dates of birth
- Social security numbers
- Beneficiary and subscriber numbers
About This Breach
October 26 is not a discovery date; the initial detection day was not published. The public individual-notice template is dated December 22, 2023.
Affected-population figures have been revised across dated sources from 4,452,782 to 4,656,293 and 4,786,241. These are reported notification populations, not accounts, emails, files, dataset rows, or locally searchable records. The latest figure should not be treated as a definitive current total without a dated federal export and an explanation of the revisions.
Notices indicate that fields varied by person and HealthEC client and may have included names, addresses, dates of birth, Social security numbers, medical record numbers, diagnoses and other medical information, prescriptions and providers, insurance or beneficiary, subscriber, Medicare or Medicaid identifiers, patient account or identification numbers, and treatment costs. No field should be assumed present for everyone.
There is no local person-level or PHI dataset; this page provides incident-notice information only. The event does not identify anyone as a patient, member, recipient of a particular client's services, holder of a diagnosis or prescription, or Medicare or Medicaid participant. Social Security, PHI, insurance, and healthcare associations must remain private, and only a direct recipient's client-specific letter is authoritative for their fields.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
