2026 Gastro Health — phishing email compromise; ~37,260 OCR-reported individuals
Data compromised
Protected health information in compromised employee email accounts (credit monitoring offered; detailed element list in patient letters)
Technical writeup
Verified company/OCR reporting summarized by HIPAA Journal (June 10, 2026 article). Gastro Health detected phishing-driven unauthorized access to employee email accounts February 25, 2026, with a further account compromised March 2, 2026. Two OCR breach filings May 22, 2026 reported 1,628 and 35,632 individuals (combined 37,260). Credit monitoring offered for 24 months. recordsAffected 37260; companyConfirmed true.
Root cause
Employee responses to phishing emails leading to unauthorized email-account access