Hafetz and Associates

Hafetz and Associates (NJ), a HIPAA-covered entity, reported a phishing-based hacking/IT incident affecting email accounts of multiple employees and the PHI of 26,474 individuals. Compromised data included names, dates of birth, SSNs, driver's license numbers, addresses, medications, claims and financial information, and health insurance information. The entity notified HHS, affected individuals, the media, and posted substitute notice; remediation included additional administrative, technical, and security safeguards.

Supplemental notification from Hafetz & Associates to the New Hampshire Attorney General regarding an incident initially reported on June 28, 2024. The firm has completed notification, mailing letters to approximately 24 New Hampshire residents.

HAFETZ & ASSOCIATES filed a data-breach notice with the Illinois Attorney General in September 2024 (case 24-09-080). The register records the breach as discovered on July 24, 2023. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

Hafetz & Associates reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2024-06-28. 112 Massachusetts residents were affected.

Hafetz & Associates reported a data breach to the Indiana Attorney General. The breach occurred on 2023-07-24 and was reported on 2024-06-28. 1 Indiana residents were affected. 2,391 individuals affected in total.

Hafetz & Associates notified the NH Attorney General of a phishing incident resulting in unauthorized access to employee email accounts between July 24 and October 12, 2023. One NH resident's name was exposed. Hafetz blocked access, investigated, and mailed notifications on June 28, 2024, offering two years of credit monitoring via Kroll.