Chronology of Data Breaches
Security Breaches 2005 - Present

Posted Date: April 20, 2005
Updated Date: December 31, 2013

Is this your first visit to our Chronology of Data Breaches?

  • Read our FAQ about what we define as a breached record, how we calculate the "total" records breached, our data sources, state breach notice laws, studies and other resources

  • Learn how to use our Chronology and take advantage of its sophisticated search and sort features

  • Get our RSS Feed to see when we add new breaches to the list

What would you like to do?


Click or unclick the boxes then select go.


Select features, then click GO.



Help Guide

Can't find the sort feature you're looking for? Click here to download a CSV file of the data breach list as it exisits today.
Breach Total
872,715,019 RECORDS BREACHED
(Please see explanation about this total.)
from 4,391 DATA BREACHES made public since 2005

Save or Print PDF of Entire Breach List including introduction.Save or Print a PDF of Entire Breach List (including introductory FAQ)

Filter breach list before saving or printing PDF. Conduct a search of the Chronology using its sorting features, and Save or Print a PDF of your search results (Select filters)

If you do not have access to PDF, you can print the Chronology in landscape view.

Date Made Public Name Entity Type
December 26, 2012 Integris Health
Oklahoma City, Oklahoma
MED HACK

Unknown

A team of cyber security consultants discovered vulnerabilities in the Omnicell web system.  Unauthorized users could gain control of certain hospital operations run by Integris Health.  The issue was immediately addressed by Omnicell.

 
Information Source:
PHIPrivacy.net
records from this breach used in our total: 0

December 4, 2012 First Step Counseling, Inc.
Metuchen, New Jersey
MED PHYS

638 (No SSNs or financial information reported)

An unauthorized disclosure of paper records may have exposed patient information.  The breach may have taken place between May 1, 2011 and August 5, 2011.  It was discovered or reported on November 16 of 2012.

 
Information Source:
HHS via PHIPrivacy.net
records from this breach used in our total: 0

December 4, 2012 CVS Caremark
Woonsocket, Rhode Island
MED PHYS

955 (No SSNs or financial information reported)

The theft of paper records may have resulted in the exposure of patient information.  The theft may have occurred on August 13, 2012 and was reported or discovered on November 16, 2012.

 
Information Source:
HHS via PHIPrivacy.net
records from this breach used in our total: 0

January 10, 2013 City of Macon Georgia
Macon, Georgia
GOV STAT

Unknown

A computer repair shop bought used computers on govdeals.com in 2011.  The computers were found to have information from city employees when they were removed from storage on January 5.  Social Security numbers, pension information, and other personal information from Macon police officers were on the computers.  Information from local businesses that was used for city purposes was also on the computers.  A total of 39 hard drives, two servers, and two CPUs were purchased and may have contained sensitive information.

 
Information Source:
Databreaches.net
records from this breach used in our total: 0

January 10, 2013 KTSU Texas Southern University
Houston, Texas
EDU INSD

Unknown

Texas Southern University's radio station KTSU gave a volunteer position to a person with a criminal history of credit card fraud.  The volunteer was later arrested for allegedly using the radio station's donation drive to steal credit card information.  The dishonest volunteer faces up to 300 counts of credit card fraud for attempting to misuse the information on donor pledge sheets.

 
Information Source:
Databreaches.net
records from this breach used in our total: 0

January 8, 2013 Morgan Road Middle School
Hephzibah, Georgia
EDU PORT

Unknown

An unencrypted flash drive was stolen from a teacher's car.  It contained student Social Security numbers and other information.  

 
Information Source:
Databreaches.net
records from this breach used in our total: 0

December 21, 2012 Fairfax High School
Fairfax, Virginia
EDU HACK

Unknown

Fairfax County Public Schools discovered that student names, ID numbers, grades, and other information were posted online.  Students enrolled in 9th, 10th, and 11th grade were affected.  The information may have only been available for a day before Fairfax County Public Schools began the process of removing it from online.  

 
Information Source:
Databreaches.net
records from this breach used in our total: 0

December 7, 2012 Rock Bottom Auto Sales
Hudson, Florida
BSR PHYS

Unknown

At least eight garbage bags that were left unattended on a dirt road contained sensitive documents.  A woman found the bags and reported the issue to a local news team.  The paperwork included credit applications with names, driver's license information, and Social Security numbers.  

 
Information Source:
Databreaches.net
records from this breach used in our total: 0

November 27, 2012 Pulaski Bank
Overland Park, Kansas
BSF PHYS

Unknown

An employee left sensitive loan application documents in a vehicle while at the gym.  The documents were stolen and included loan applicant tax returns. The breach occurred in September.

 
Information Source:
Databreaches.net
records from this breach used in our total: 0

November 22, 2012 Scripps College
Anaheim, California
EDU PHYS

940 (No SSNs or financial information reported)

Scripps College is located in Claremont, California and the theft took place in Anaheim, California.

Sensitive records were stolen from a tote bag in a staff member's vehicle on the night of November 18.  The records included names, dates of birth, cell phone numbers, email addresses, and emergency contact information.

 
Information Source:
Databreaches.net
records from this breach used in our total: 0

October 19, 2012 The College of St. Scholastica
Duluth, Minnesota
EDU HACK

28 (No SSNs or financial information exposed)

Hackers were able to guess the answers to student account challenge questions.  The email account passwords of at least 28 students were reset and their account information was most likely accessed. The hackers may have been based in Beijing and most likely gathered the information needed to pass the challenge questions from information on the students' Facebook pages.

 
Information Source:
Databreaches.net
records from this breach used in our total: 0

January 7, 2013 Centric Group, LLC
St. Louis, Missouri
BSR UNKN

Unknown

It is not clear if this breach is related to the August 2010 theft of a laptop from Centric Software in Campbell, California.

Those with questions may call 1-800-416-4601.

Anyone who purchased items on www.accesscatalog.com using a credit card may have been affected by a breach that began in August 2010.  An unauthorized party may have obtained names, credit or debit card numbers, expiration dates, and payment card verification codes.  Centric Group learned of the incident on or around December 13, 2012.

 
Information Source:
California Attorney General
records from this breach used in our total: 0

January 7, 2013 Office of Dr. Calvin L. Schuster
Reedley, California
MED STAT

532 (No SSNs or financial information reported)

Those with questions may call Dr. Schuster's office at 1-855-638-1443.

A computer was stolen during an office burglary that occurred sometime around November 5, 2012.  The computer contained patient names, dates of birth, and a minimal amount of patient medical information.

 
Information Source:
California Attorney General
records from this breach used in our total: 0

January 11, 2013 EJ Phair Brewing Company and Alehouse
Concord, California
BSR HACK

Unknown

Customers who used credit or debit cards at EJ Phair discovered fraudulent chargers on their payment cards.  A hacker or hackers managed to access and misuse payment card numbers once they ran through EJ Phair's system.  It appears that customers who used cards at the location between September and late November of 2012 may have been affected.

 
Information Source:
California Attorney General
records from this breach used in our total: 0

August 14, 2012 Creative Croissants
San Jose, California
BSR UNKN

Unknown

A breach at Creative Croissants results in the exposure of customer credit card information.  It is unclear how the breach occurred and the date of the breach was March 2, 2012.

 
Information Source:
California Attorney General
records from this breach used in our total: 0

January 10, 2013 Office of Dr. Sandra Bujanda-Wagner
Aurora, Colorado
MED PHYS

Unknown

Employees accidentally threw out hundreds of patient records.  The dental records were found by someone looking through a dumpster and the incident was reported to a local news team.  Names, Social Security numbers, dates of birth and addresses were exposed. Employees from Bujanda-Wagner's office came to recover the documents.

 
Information Source:
PHIPrivacy.net
records from this breach used in our total: 0

January 8, 2013 Texas Department of Health and Human Services
Austin, Texas
MED INSD

Unknown

A dishonest employee was arrested on suspicion of misusing client information to apply for credit cards.  The dishonest employee was able to pose as different clients seeking immunizations and other services.  She was charged with fraudulent use or possession of identifying information and credit card abuse.  

UPDATE (01/31/2013): The employee was working for the Northeast Texas Public Health district when she was arrested for stealing the identities of patients at a clinic in Mount Pleasant.  She began working in the Texas Department of State Health Services clinic in 2008.

 
Information Source:
PHIPrivacy.net
records from this breach used in our total: 0

January 7, 2013 Woodwinds Hospital
Woodbury, Minnesota
MED INSD

Unknown

An employee kept 200 pages of confidential information in an effort to prove that Woodwinds Hospital was trying to conceal evidence of medical misconduct.  The employee was discharged in 2010 for reasons unrelated to removing the information.  She claims to have taken them home after being ordered to destroy any information related to incidents that could damage Woodwinds Hospital's reputation.

 
Information Source:
PHIPrivacy.net
records from this breach used in our total: 0

December 21, 2012 Workers United
New York, New York
BSO PORT

Unknown

The theft of a hard drive from the office of an unnamed independent contractor resulted in the exposure of sensitive information.  The theft occurred on either October 13 or 14 of 2012 and Workers United learned of the issue on October 25.  A database with former Workers United member names and Social Security numbers was on the hard drive.

 
Information Source:
Databreaches.net
records from this breach used in our total: 0

January 18, 2013 Stanford School of Medicine, Lucile Packard Children's Hospital
Palo Alto, California
MED PORT

Unknown

Those with questions may call 1-855-731-6016.

The January 9 theft of a laptop from a physician's car may have exposed sensitive information.  The laptop may have contained some combination of patient names, dates of birth, and contact information.

UPDATE (01/22/2013): A total of 57,000 patients are being notified. Medical information and medical record numbers were exposed.  A limited number of patients had their contact information exposed.  Most of the information on the laptop was from 2009.

 
Information Source:
California Attorney General
records from this breach used in our total: 0

January 22, 2013 NECA/IBEW Family Medical Care Plan
Rockville, Maryland
MED DISC

Unknown

NECA/IBEM Family Medical Care Plan (FMCP) participants received disclosure documents related to benefits coverage and modifications.  The outside of the envelopes in which the documents arrived displayed participant Social Security numbers.

 
Information Source:
California Attorney General
records from this breach used in our total: 0

January 26, 2013 Wilton Brands LLC, www.wilton.com
Woodridge, Illinois
BSR HACK

Unknown

Customers who made purchases on www.wilton.com between October 8, 2012 and January 8, 2013 may have had their credit or debit card information exposed.  A Wilton service provider discovered the issue on or around January 8, 2013.  A malicious user accessed the website information and payment card numbers, expiration dates, and security codes may have been exposed.  Customer names, addresses, and telephone numbers are also at risk.

This incident is in addition to the hacking incident that took place between July and October of 2012.  That incident was reported on December 12, 2012.

 
Information Source:
California Attorney General
records from this breach used in our total: 0

January 24, 2013 Eastern Illinois University
Charleston, Illinois
EDU DISC

430 (No SSNs or financial information reported)

At least 65 students received information about the grade point average of 430 students during early January 2013.  The breach occurred when a spreadsheet that contained the information and the E-number of 430 students was accidentally made available online.  

 
Information Source:
Databreaches.net
records from this breach used in our total: 0

January 12, 2013 Zaxby's
Athens, Georgia
BSR HACK

Unknown

Over 108 Zaxby's restaurants experienced a breach related to customer credit and debit cards.  A number of people experienced credit card fraud and an investigation led to Zaxby's as a common point of purchase.  Suspicious files were found on Zaxby's system during the subsequent investigation.  

 
Information Source:
Databreaches.net
records from this breach used in our total: 0

January 12, 2013 Florida Department of Juvenile Justice
Tallahassee, Florida
GOV PORT

100,000 (No SSNs or financial information reported)

A press release can be found here: http://www.djj.state.fl.us/news/press-releases/press-release-detail/2013/01/11/information-security-breach-reported-at-djj

A mobile device that contained both youth and employee records was reported stolen on January 2, 2013.  Over 100,000 records were on the device and may have been exposed.  The device was taken from a Department of Juvenile Justice office and was neither encrypted nor password-protected.  Department of Juvenile Justice policy requires such devices to be encrypted.

 
Information Source:
Databreaches.net
records from this breach used in our total: 0

January 12, 2013 Florida Department of Juvenile Justice
Tallahassee, Florida
MED STAT

100,000 (No SSNs or financial information reported)

On September 6, 2012 it was reported that three computers that contained information from the Florida Department of Juvenile Justice were stolen from an apartment site earlier in the week.  A television was also taken at the time of the theft.

UPDATE (01/12/2013): At least one of the devices was neither encrypted nor password protected and held the personal information of over 100,000 youth and employees.

 
Information Source:
Databreaches.net
records from this breach used in our total: 0

January 29, 2013 North Los Angeles County Regional Center (NLACRC)
Van Nuys, California
MED PORT

Unknown

The November 13, 2012 theft of a laptop resulted in the exposure of consumer information.  Names, addresses, phone numbers, dates of birth, residential information, and medical information may have been exposed.

 
Information Source:
California Attorney General
records from this breach used in our total: 0

January 28, 2013 Walz and Associates Law Firm
Albuquerque, New Mexico
BSO PHYS

Unknown

A concerned citizen found hundreds of documents in a recycling center and notified a local news team.  The documents included criminal histories, depositions, medical records, personal phone numbers, and addresses.  Most were from the 1990's.  Most or all of the information did not need to be shredded because it was considered public record.  The local news team contacted a director from the solid waste division and the documents were removed for shredding.

 
Information Source:
PHIPrivacy.net
records from this breach used in our total: 0

January 29, 2013 Stethescope.com
Natick, Massachusetts
BSR HACK

Unknown

Those with questions may call (877) 288-8057.

A hacker accessed the webserver used to host stethoscope.com on December 3.  The breach was discovered in mid-December during routine server maintenance.  Customer names, addresses, email addresses, and credit card information such as numbers, expiration dates, and security codes may have been exposed.

 
Information Source:
California Attorney General
records from this breach used in our total: 0

February 1, 2013 Antioch Unified School District
Antioch, California
EDU DISC

Unknown

A document with sensitive Worker's Compensation claim information was accidentally sent out with an email to a limited number of Antioch Unified School District employees.  Social Security numbers and other information related to current and former employees that reported injuries were exposed.  The incident occurred on January 18 and people who received the email were instructed to remove and destroy any saved information contain in the email. Those who received the email were also instructed to provide written verification that they had removed and destroyed the information.

 
Information Source:
California Attorney General
records from this breach used in our total: 0

February 2, 2013 River Falls Medical Clinic
River Falls, Wisconsin
MED PHYS

2,400 (unknown number of SSNs)

River Falls Medical Clinic officials reported a burglary during the summer of 2012.  The equipment and paper documents that were stolen were recovered by police on November 28.  An employee of a cleaning service that subcontracted with the Clinic is the main suspect.  The items were found in the employee's home and he was charged with felonies associated with theft and drug possession.  It is believed that the documents were intended to be shredded.  They contained patient names, dates of birth, patient account and billing account information, diagnosis codes, insurance information, account numbers, medical chart numbers, and scheduling information.  An unspecified number of patients also had their Social Security numbers, home addresses, and phone numbers exposed.

 
Information Source:
PHIPrivacy.net
records from this breach used in our total: 0

February 1, 2013 Central Laborers' Pension Fund, Central Laborers' Welfare Fund, Central Laborers' Annuity Fund
, Illinois
BSF PORT

Unknown

A home burglary resulted in the theft of a CD that contained the information of over 30,000 beneficiaries.  The CD contained names, Social Security numbers, and dates of birth and was taken from the home of an accountant at an unnamed counting firm.  The three funds sued the accounting firm for $200,000 to cover the cost of credit monitoring and insurance. 

 
Information Source:
Databreaches.net
records from this breach used in our total: 0

February 3, 2013 Premier Tax
, Alabama
BSF INSD

Unknown

The area of Alabama where the breach occurred is unclear.

Six people who worked in tax preparation were charged with fraud and filing false tax returns in March of 2012.  Over 1,000 false tax returns were filed between October 2009 and April 2012.  The fraudulent returns totalled more than $1.7 million.  

UPDATE (01/29/2013): Two others were linked to the conspiracy and charged.  One of them was an employee of an unnamed Alabama state agency. She was able to access a state database of personal information and provide it to others in the identity theft ring.

 
Information Source:
Databreaches.net
records from this breach used in our total: 0

February 2, 2013 Twitter
San Francisco, California
BSO HACK

250,000 (no SSNs or financial information exposed)

Online attackers were able to access the usernames, email addresses, session tokens, and encrypted passwords of 250,000 users.  Twitter notified affected users and told them to create a new password.  Anyone who used the same password and username or email combination for other sites is encouraged to change the password on other sites as well.

UPDATE (03/11/2013): Facebook, Microsoft, and Apple were all affected by a similar breach around the same time.

 
Information Source:
Media
records from this breach used in our total: 0

January 30, 2013 The New York Times
New York, New York
BSO HACK

Unknown

The New York Times' computer system was hacked after Chinese government officials warned the Times about consequences for investigating the wealth of government family members.  The Times began monitoring its system closely on October 24 and noticed unusual activity on October 25 when an article about the wealth of a Chinese official's family was published.  The breach began on September 13 and was allowed to continue until January so that the hackers' behavior could be studied.  It appears that the passwords of every Times employee were compromised and 53 Times employees had their personal computers accessed.  The 53 employees were located outside of the United States and appear to have been the ones who may have covered the Chinese stories.

 
Information Source:
Media
records from this breach used in our total: 0

December 21, 2011 United States Chamber of Commerce
Washington, District Of Columbia
NGO HACK

3,000,000 (No SSNs or financial information reported)

Hackers in China were able to breach the computer system of the United States Chamber of Commerce.  The hackers had access to the information of roughly three million members from November 2009 to May 2010.  Though the breach was discovered in May of 2010, there is evidence that some systems were still compromised in March of 2011.  Email communications with no more than 50 of the Chambers' members were compromised. Company names, key company contacts, trade-policy documents, meeting notes, trip reports, and schedules were in the email communications.

 
Information Source:
Media
records from this breach used in our total: 0

February 5, 2013 Boca Raton Regional Hospital
Boca Raton, Florida
MED INSD

Unknown

Eight people were charged for participating in an identity theft ring.  One of the members was employed as a scheduler at Boca Raton Regional Hospital.  She passed along patient information in exchange for payments.  One member allegedly filed 57 fraudulent tax returns with the stolen information in attempt to get $306,720 in refunds.  Another member is accused of filing 75 fraudulent returns for $750,469 in refunds.

UPDATE (07/30/2013): The dishonest employee was convicted of unauthorized disclosure of medical records, using stolen Social Security numbers to file fraudulent tax claims, and conspiracy to commit false claims.  She was sentenced to 18 months in prison and ordered to pay $15,795 in restitution to the IRS.  A co-defendant was sentenced to 40 months for her role in filing fraudulent tax returns and stealing patient information.

 
Information Source:
PHIPrivacy.net
records from this breach used in our total: 0

February 6, 2013 Bashas'
Chandler, Arizona
BSR HACK

Unknown

The location of the breach is listed as the corporate headquarters of Bashas'

Bashas' online systems suffered an online breach.  Customers in Lake Havasu City and Pinal County who entered their credit and debit card information online have been affected.  All customers are being warned to check their payment card transactions for suspicious activity.

 
Information Source:
Dataloss DB
records from this breach used in our total: 0

February 7, 2013 THORLO
Statesville, North Carolina
BSR HACK

Unknown

Hackers were able to access customer credit card information stored on computer servers.  The cyber attack affected customers who made purchases on www.thorlo.com between November 14, 2012 and January 22, 2013.  Credit card numbers, credit card expiration dates, credit card security codes, names, and contact information were exposed. 

 
Information Source:
California Attorney General
records from this breach used in our total: 0

February 7, 2013 Schneider-Electric
Palatine, Illinois
BSO DISC

Unknown

A vendor's mailing error resulted in the exposure of employee Social Security numbers.  Call for Candidacy letters were mailed sometime around January 16 that had Social Security numbers, names, and addresses visible through the address window of the letter.  

 
Information Source:
California Attorney General
records from this breach used in our total: 0

February 7, 2013 Wayne Memorial Hospital
Honesdale, Pennsylvania
MED PORT

1,182 (No SSNs or financial information reported)

An unencrypted disc that contained patient information was lost in transit.  The disc had names, Medicare account numbers, and outstanding account balances from patients who visited the Honesdale hospital between 2007 and 2012.  A legal envelope that contained the disc was mailed on November 28 and arrived at Novitas Solutions in Pittsburgh in a cardboard box without the disc. 

 
Information Source:
PHIPrivacy.net
records from this breach used in our total: 0

February 7, 2013 McDonald's, Shogun Japanese Steakhouse, Krystal, Polished Nail Salon
, Georgia
BSR INSD

Unknown

Dishonest employees from multiple cities and states were involved. The location listed is the state where many fraudulent purchases took place.

Eleven people were charged with participating in an identity theft ring.  Some of the defendants obtained customer credit and debit card information by using skimmers at their places of employment.  Others used the stolen information to make fraudulent payment cards.  The ring was in action between June of 2009 and November of 2010.

 
Information Source:
Dataloss DB
records from this breach used in our total: 0

February 4, 2013 Alabama Criminal Justice Information Center
Montgomery, Alabama
NGO HACK

4,000 (No SSNs or financial information reported)

Information related to over 4,000 American bank executive accounts was exposed by hackers.  Hackers placed an Alabama Criminal Justice Information Center spreadsheet with the login information, credentials, contact information, and IP addresses of bank executives online.

 
Information Source:
Dataloss DB
records from this breach used in our total: 0

February 8, 2013 Talk Fusion
Brandon, Florida
BSO HACK

Unknown

A computer network attack resulted in the exposure of customer information.  The cyber attack was discovered on December 13, 2012 and affected customer databases with names, Social Security numbers, credit and debit card numbers, payment card expiration dates, payment card security codes, addresses, telephone numbers, dates of birth, and mothers' maiden names may have been exposed.

 
Information Source:
California Attorney General
records from this breach used in our total: 0

February 11, 2013 Crafts Americana Group, Inc. (Knitpicks.com, ArtistsClub.com, ConnectingThreads.com)
Columbus, Ohio
BSR DISC

Unknown

Customers who had credit card numbers on file after using them at Knitpicks.com, ArtistsClub.com, or ConnectingThreads.com may have had their information exposed.  A file on the Crafts Americana Group, Inc. servers was accessible for a period of time before being removed on January 25, 2013.  The file contained names, credit card numbers, addresses, and phone numbers.

 
Information Source:
California Attorney General
records from this breach used in our total: 0

February 17, 2013 Sierra View District Hospital
Porterville, California
MED HACK

Unknown

The Information Technology Department at Sierra View District Hospital detected unusual activity on its computer network.  Patient information may have been affected and the investigation is ongoing.

 
Information Source:
PHIPrivacy.net
records from this breach used in our total: 0

February 17, 2013 Heyman HospiceCare, Floyd Medical Center
Rome, Georgia
MED PORT

Unknown

The theft of a password-protected laptop from an employee's car may have resulted in the exposure of patient information.  The theft occurred on January 4, 2013 and was reported immediately.  Patients who were treated between July 1, 2006 and January 3, 2013 may have had their names, Social Security numbers, addresses, phone numbers, dates of birth, insurance policy numbers, diagnoses, visit notes, physician names, caregiver names, and advance directives exposed.

 
Information Source:
PHIPrivacy.net
records from this breach used in our total: 0

February 15, 2013 Walgreens
Richmond, Kentucky
BSR INSD

Unknown

A Walgreens pharmacist used patient information to obtain prescriptions for powerful drugs.  The fraudulent activity occurred between April 2011 and January 2012.  The dishonest pharmacist pleaded guilty to aggravated identity theft, wire fraud, and fraudulently acquiring controlled substances on November 19, 2012.

She was sentenced to 25 months in prison and one month of supervised release.

 
Information Source:
PHIPrivacy.net
records from this breach used in our total: 0

February 13, 2013 Sinai Medical Center of Jersey City LLC
Jersey City, New Jersey
MED INSD

Unknown

A pediatrician misused patient information in order to defraud Medicaid of nearly one million dollars.  The pediatrician owned Sinai Medical Center and billed Medicaid for wound repairs and other procedures that were never performed.  Police arrested the dishonest pediatrician on January 16, 2013.  

 
Information Source:
PHIPrivacy.net
records from this breach used in our total: 0

February 11, 2013 Lee Miller Rehab Associates
Baltimore, Maryland
MED STAT

10,480 (No SSNs or financial information reported)

A network server was stolen or discovered stolen on January 15, 2012.  The incident appeared on the HHS website in February of 2013.

 
Information Source:
HHS via PHIPrivacy.net
records from this breach used in our total: 0

Breach Total
872,715,019 RECORDS BREACHED
(Please see explanation about this total.)
from 4,391 DATA BREACHES made public since 2005
Showing 3801-3850 of 4391 results


X

Sign In!

Loading