University of Rochester

University of Rochester notified NH AG of a MOVEit file transfer vulnerability exploited by an unauthorized third party via Progress Software. Incident occurred May 27, 2023; discovered May 31, 2023. Approximately 138 NH residents affected with PII/SSN. Notifications sent July 28, 2023, offering 2 years credit monitoring.

University of Rochester notified Vermont AG of a data breach involving its MOVEit File Transfer vendor, Progress Software. An unauthorized third party exploited a vulnerability on May 27, 2023, to access personal information. Files containing personal info were potentially removed on July 19, 2023. The university engaged investigators and offered 24 months of credit monitoring.

Maine AG notice for University of Rochester breach occurring 05/27/2023, discovered 07/19/2023. Third-party vendor unauthorized access exposed names and SSNs. 88,025 total individuals affected (91 Maine residents). Notification sent 07/28/2023 offering 2 years of Experian IdentityWorks.

University of Rochester notified Montana residents of a third-party vendor breach involving Progress Software's MOVEit File Transfer solution. An unauthorized party exploited a vulnerability on May 27, 2023, to access data. The University discovered files containing personal information were removed on July 19, 2023. The University engaged investigators and offered 24 months of credit monitoring.

University of Rochester reported a data breach to the Indiana Attorney General. The breach occurred on 2023-05-27 and was reported on 2023-07-28. 86 Indiana residents were affected. 88,025 individuals affected in total.

University of Rochester reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-07-28. 962 Massachusetts residents were affected. The report records the breach type as electronic.

University of Rochester notified individuals of a data breach involving its third-party vendor, Progress Software. An unauthorized party exploited a vulnerability in the MOVEit File Transfer solution between May 27 and May 31, 2023, to access and potentially exfiltrate personal information, including Social Security numbers. The University engaged outside professionals to investigate and is offering 24 months of complimentary identity protection services.

University of Rochester

University of Rochester Medical Center and Affiliates reported to HHS OCR on 2015-05-22 an Unauthorized Access/Disclosure affecting 3,403 individuals via loss of an unencrypted flash drive (2013) and theft of an unencrypted laptop (2017). OCR found URMC failed to implement encryption and risk analysis. URMC agreed to pay $3 million and undertook a corrective action plan with two years of HIPAA compliance monitoring.

The University of Rochester Medical Center & Affiliates reported a breach to HHS on May 6, 2013, after losing an unencrypted portable electronic device containing the protected health information of 537 individuals. An investigation by the HHS Office for Civil Rights (OCR) revealed systemic failures, including a lack of enterprise-wide risk analysis and failure to encrypt mobile devices. This incident, along with a similar one in 2017, resulted in a $3 million settlement with OCR and a mandated corrective action plan.

University of Rochester Medical Center and Affiliates reported to HHS on 2010-09-07 a Loss affecting 857 individuals. Breached information located on Other Portable Electronic Device.

University of Rochester Medical Center and Affiliates reported to HHS on 2010-05-20 an 'Other' breach (accidental misdelivery of paper records) affecting 2,628 individuals. On April 19, 2010, 2,628 patient billing statements for Strong Memorial Hospital were mailed to wrong patients. Statements contained names, addresses, SSNs, health insurance plan details, subscriber numbers, dollar amounts owed, and service descriptions. Breached information located on Paper/Films. Remediation included mechanical counters, per-run page reports, and manual QC envelope inspection.