YALE UNIVERSITY

The Seltzer Firm, on behalf of Yale University, reported an external system breach (hacking) occurring on December 10, 2024, discovered on February 4, 2025. The incident affected 335 individuals, including 1 Maine resident. Personal identifiers were compromised. Affected individuals were notified on March 12, 2025, and offered 12 months of credit monitoring and identity protection services via Cyberscout.

Yale University reported a ransomware incident affecting at least one New Hampshire resident. Unauthorized access occurred around August 11, 2022, detected September 12, 2022. Patient data from Connecticut Plastic Surgery Group (2009-2021) was encrypted, including PHI, SSNs, and credit card numbers. Yale notified the NH AG on Nov 11, 2022, and offered 24 months of credit monitoring.

Yale University (CT) reported to HHS OCR on 2022-11-11 a ransomware incident affecting 9,051 individuals. Breached PHI was located on a Network Server and included names, Social Security numbers, addresses, driver's license numbers, dates of birth, financial and claims information, diagnoses, medications, and other treatment information. Yale notified HHS, affected individuals, and media, posted substitute notice, offered free credit monitoring, and implemented additional safeguards and staff retraining.

Yale University reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2022-11-11. 7 Massachusetts residents were affected. The report records the breach type as electronic.

Yale University reported to HHS on October 17, 2018, that a mailing error affected 1,102 individuals. Due to a collating error discovered in September 2018, letters containing demographic and clinical information were sent to incorrect addresses. The breach involved paper records. In response, the university sanctioned and retrained employees and updated its mailing procedures. OCR reviewed the university's policies and confirmed compliance.

Yale University reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2018-07-30. 6,871 Massachusetts residents were affected. The report records the breach type as electronic.

Yale University reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2018-07-30. 4 Massachusetts residents were affected. The report records the breach type as electronic.

Yale University notified the Washington AG of a breach where intruders accessed a database between April 2008 and January 2009, extracting names, SSNs, and DOBs of ~119,000 individuals. Yale discovered the intrusion on June 16, 2018, during a security review. Notices were mailed starting July 26, 2018, offering 12 months of Kroll identity monitoring.

Yale University reported a data breach to the Oregon Attorney General. The breach was reported on 2018-07-27. The breach occurred during 4/1/2008 - 4/1/2008. The breach was discovered on 6/16/2018. 119,000 individuals were affected. Notice was sent on 7/27/2018.

Yale University notified New Hampshire residents of a breach where intruders accessed a database between April 2008 and January 2009, extracting names, SSNs, DOBs, and contact info. Yale discovered the intrusion on June 16, 2018. The university offered 12 months of identity monitoring via Kroll.

Yale University reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2011-08-12. 1,572 Massachusetts residents were affected. The report records the breach type as electronic.

Yale University notified the NH AG of a security breach involving names and SSNs of NH residents. An internal affiliate accessed a file via Google search on June 30, 2011. The file was misconfigured on an FTP server since July 2005 and became searchable by Google in Sept 2010. Yale is offering credit warnings and reviewing archival storage procedures.

Yale University reported to HHS on 2010-08-18 a Theft affecting approximately 1,000 individuals. An unsecured laptop was stolen from an office building on Yale's premises; it contained PHI from the Ryan White Part A program including names, dates of birth, diagnoses/conditions, medications, lab results, and other treatment information. Breached information was located on a Laptop. OCR obtained assurances that corrective actions were implemented, including mandatory mobile device encryption and mandatory Privacy and Security Awareness training.