2026 Sunshine Health — vishing May 6; 41,569 members PHI (names, DOB, medical/coverage)
Data compromised
PHI of 41,569 individuals: names, dates of birth, medical information/histories, health plan coverage information per HIPAA Journal / company notice summaries
Technical writeup
Verified healthcare breach — reported August 11, 2026 (HIPAA Journal). Sunshine Health, a Florida Medicaid/health insurance agency, said a May 6, 2026 vishing call tricked an employee into sharing a limited set of health plan files; the incident was identified the same day. Review found PHI for 41,569 individuals including names, dates of birth, medical information/histories, and health plan coverage. Sunshine Health offered credit monitoring/identity protection, provided workforce training, and said it had not found evidence of misuse at reporting. BreachHistory indexes recordsAffected 41569 per the company/HIPAA Journal count.
Root cause
Vishing: employee tricked into sharing a limited number of health plan files with a caller posing as a trusted individual (May 6, 2026; identified same day)