YALE UNIVERSITY

The Seltzer Firm, acting on behalf of Yale University, reported an external system breach (hacking) that occurred on December 10, 2024, and was discovered on February 4, 2025. A total of 335 individuals were affected, including 1 Maine resident. Affected individuals were notified by written notice on March 12, 2025, and offered 12 months of credit monitoring and identity protection services through CyberScout, a TransUnion company.

Yale University reported a ransomware incident affecting at least one New Hampshire resident. Unauthorized access occurred around August 11, 2022, detected September 12, 2022. Patient data from Connecticut Plastic Surgery Group (2009-2021) was encrypted, including PHI, SSNs, and credit card numbers. Yale notified the NH AG on Nov 11, 2022, and offered 24 months of credit monitoring.

Yale University (CT) reported to HHS OCR on 2022-11-11 a ransomware incident affecting 9,051 individuals. Breached PHI was located on a Network Server and included names, Social Security numbers, addresses, driver's license numbers, dates of birth, financial and claims information, diagnoses, medications, and other treatment information. Yale notified HHS, affected individuals, and media, posted substitute notice, offered free credit monitoring, and implemented additional safeguards and staff retraining.

Yale University reported to HHS on October 17, 2018, that a mailing error affected 1,102 individuals. Due to a collating error discovered in September 2018, letters containing demographic and clinical information were sent to incorrect addresses. The breach involved paper records. In response, the university sanctioned and retrained employees and updated its mailing procedures. OCR reviewed the university's policies and confirmed compliance.

Yale University, a education sector entity reported a unclear/unknown incident to the Washington Attorney General. The organization became aware of the incident on 2018-06-16 and filed notice on 2018-07-27. 1,742 Washington residents were affected. 41 days elapsed between awareness and notification. 3728 days to identify the breach. 0 days to contain the breach.

Yale University reported a data breach to the Oregon Attorney General. The breach was reported on 2018-07-27. The breach occurred during 4/1/2008 - 4/1/2008. The breach was discovered on 6/16/2018. 119,000 individuals were affected. Notice was sent on 7/27/2018.

Yale University filed a New Hampshire Attorney General breach notification on August 9, 2011. The incident involved unauthorized access to a database containing names and Social Security numbers of approximately 43,000 individuals. Yale offered two years of credit monitoring to affected individuals. The State Attorney General's office was investigating the breach.

Yale University reported to HHS on 2010-08-18 a Theft affecting approximately 1,000 individuals. An unsecured laptop was stolen from an office building on Yale's premises; it contained PHI from the Ryan White Part A program including names, dates of birth, diagnoses/conditions, medications, lab results, and other treatment information. Breached information was located on a Laptop. OCR obtained assurances that corrective actions were implemented, including mandatory mobile device encryption and mandatory Privacy and Security Awareness training.