Covenant Care was allegedly attacked by Hunters International which exposed patients’ protected health information (PHI) and employees’ personal information. The compromised information includes names, dates of birth, dates of death, Social Security numbers, medical record numbers, health insurance information, clinical information, and treatment information. CCC put extra administrative and technical protections to protect its PHI in response to this compromise. Free credit monitoring and identity theft restoration services were extended to the affected consumers. In addition, OCR gave CCC technical support for its security management procedure and secured confirmation that CCC carried out the aforementioned corrective activities.

On August 29, 2024, the California Office of the Attorney General reported a data breach incident involving Covenant Care California, LLC. The breach occurred between November 12 and November 14, 2023, and may have involved unauthorized copying of personal information, including names. The number of individuals affected is currently unknown.

On May 9, 2022, the California Office of the Attorney General reported a data breach involving Covenant Care California, LLC that occurred on February 24, 2022. The breach involved unauthorized access to an employee's email account via a phishing email, potentially affecting an undisclosed number of individuals, and patient records were involved.

The California Office of the Attorney General disclosed a data breach at Covenant Care California, LLC, where an unauthorized party gained access to an employee’s email account between January 22, 2019, and January 29, 2019. The incident exposed sensitive personal information of 7,585 California residents, including names, Social Security numbers, and medical records. The breach was identified after the unauthorized access, and notifications were issued to affected individuals on March 6, 2019. The compromised data poses significant risks, such as identity theft, financial fraud, and potential misuse of medical records. While the breach was limited to a single email account, the nature of the exposed information—particularly Social Security numbers and medical details—heightens the severity. The company likely faced regulatory scrutiny under California’s data protection laws, including potential penalties for failing to safeguard sensitive data. The incident underscores vulnerabilities in email security protocols and the critical need for robust access controls, monitoring, and employee training to prevent similar breaches in healthcare organizations, where patient confidentiality is paramount.