HEALTHSTREAM, INC.
ent_019fa1f1d3b3db19f7cb38d821c6b3de
Disclosures
4
State AG · 4 jurisdictions
Multi-filing incidents
1
incidents joining 2+ filings here
Max affected reported
1,631
nationwide · State AG IN
Leak-site claims
0
none in sample
Identity resolution
- Canonical name
- HEALTHSTREAM, INC.
- Normalized
- healthstream— dedupe via name-norm; Microsoft / MSFT collapse to one row
- GLEIF LEI
- 529900OJ88H8635JNH64
- SEC EDGAR CIK
- 0001095565
- Domain
- None on record
Disclosure history (4)newest first
- New Hampshire State AGas victim2026-09-14
HealthStream, Inc. notified the NH Attorney General of unauthorized access to its internal corporate network between July 16-17, 2026, discovered on July 19, 2026. The incident affected 5 New Hampshire residents, involving exposure of names, Social Security numbers, and potentially driver's license numbers for employees. The investigation is ongoing. HealthStream engaged third-party cybersecurity specialists, notified federal law enforcement, and is offering 12 months of credit monitoring through Epiq.
- Vermont State AGas victim2026-09-14
HealthStream, Inc. reported a data breach to the Vermont Attorney General. The breach was reported to the AGO on 2026-09-14. The reporting organization type is Other Commercial. 4 Vermont residents were affected. Categories of data breached: Social Security Numbers, Government ID Numbers.
- Indiana State AGas victim2026-09-14
HealthStream Inc reported a data breach to the Indiana Attorney General. The breach occurred on 2026-07-16 and was reported on 2026-09-14. 18 Indiana residents were affected. 1,631 individuals affected in total.
- Massachusetts State AGas victim2026-09-01
HealthStream, Inc. notified Massachusetts residents of an incident involving their personal information. Due to Massachusetts law requirements, the company could not disclose details about the nature of the incident. HealthStream is offering 24 months of complimentary credit monitoring and identity theft protection services through Epiq to affected individuals. The notice does not specify the number of individuals affected, the dates of the incident, or the specific types of data compromised beyond general personal information.