Yale New Haven Health Services Corporation

Yale New Haven Health System reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2025-04-11. 312,085 Massachusetts residents were affected.

Yale New Haven Health System (CT, healthcare provider) reported to HHS OCR a hacking/IT incident affecting a network server that compromised PHI of 5,556,702 individuals. Data elements included names, dates of birth, addresses, and Social Security numbers. The entity notified HHS, affected individuals, the media, and provided substitute notice, and implemented additional administrative, technical, and security safeguards. The OCR Wall of Shame entry indicates no business associate was involved.

Yale New Haven Health notified individuals of a security incident involving its vendor, Tobin, Carberry, O'Malley, Riley & Selinger, P.C. An unauthorized third party accessed TCORS's network from November 10-30, 2023, copying files containing patient information. YNHHS was notified on December 4, 2023. Notices were sent on November 18, 2024, offering identity theft protection services. The incident involved a supply chain compromise where a third-party vendor's credentials were likely used.

Supplemental notice regarding a cybersecurity incident at vendor Tobin, Carberry, O'Malley, Riley & Selinger, P.C. (TCORS), a business associate of Yale New Haven Health (YNHH). Unauthorized access occurred Nov 10-30, 2023. TCORS notified YNHH on Dec 4, 2023. YNHH notified 5 impacted individuals on July 19, 2024. Data included PII, SSN, PHI, and bank info. Third-party forensics engaged. Identity theft protection offered.

Yale New Haven Health (YNHHS) notified consumers of a data breach involving its vendor, Tobin, Carberry, O'Malley, Riley & Selinger, P.C. (TCORS). An unauthorized third party accessed TCORS's network between November 10 and 30, 2023, copying files containing patient PII and PHI, including SSNs, DOBs, and medical history. YNHHS is offering one year of identity theft protection. The incident affected at least 689 Rhode Island residents.

Yale New Haven Health Services Corporation reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2021-07-23. 7 Massachusetts residents were affected. The report records the breach type as electronic.

Yale New Haven Health Services Corporation reported to HHS on 2021-07-23 a Hacking/IT Incident affecting 14603 individuals. Breached information located on Network Server. A business associate was the victim of a cyber-attack compromising PHI including names, addresses, SSNs, and treatment info.

Yale New Haven Health Services Corporation (YNHHS) notified the New Hampshire Attorney General of a security incident involving its vendor, Elekta, Inc. An unauthorized party accessed Elekta's SmartClinic database between April 2 and April 20, 2021, exfiltrating patient data including names, SSNs, and PHI. YNHHS identified 2 affected New Hampshire residents. YNHHS offered 24 months of credit monitoring and established a call center. The incident was part of a broader ransomware attack on Elekta's clients.

YALE NEW HAVEN HEALTH SERVICES CORPORATION filed a data-breach notice with the Illinois Attorney General during 2021 (case 21-290). The register records the breach as discovered on May 26, 2021. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

Lawrence + Memorial Hospital (Yale New Haven Health) notified NH AG of a Blackbaud ransomware breach affecting 97 NH residents. Attack occurred Feb-May 2020. Data included names, addresses, DOB, philanthropic history, provider names, dates of service, and one credit card number. Vendor Blackbaud paid ransom; data destroyed. Notifications sent Oct 13, 2020.

Yale New Haven Health Services reported to HHS on 2020-06-05 a Unauthorized Access/Disclosure affecting 506 individuals. Breached information located on Electronic Medical Record. The incident involved ePHI related to COVID-19 testing exported between systems, exposing names, birth dates, medical record numbers, telephone numbers, and clinical/treatment information. The CE retrained staff to prevent recurrence.

Yale New Haven Health reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2019-11-08. 130 Massachusetts residents were affected. The report records the breach type as electronic.

Yale New Haven Health notified Montana residents that employee data, including names and Social Security numbers, was potentially accessible via the intranet due to a misconfigured password setting from July 3-17, 2019. The issue was corrected, data removed, and credit monitoring offered.