The California Office of the Attorney General reported a data breach involving Joslin Diabetes Center on September 18, 2020. The breach was related to a ransomware incident discovered by Blackbaud on May 14, 2020, with potential exposure of customer data, including names and treatment information, though no financial or social security information was involved.

The Washington State Office of the Attorney General disclosed a ransomware attack targeting the Joslin Diabetes Center between February 7, 2020, and May 20, 2020, officially reported on September 18, 2020. The incident compromised sensitive personal and medical data of 1,212 Washington residents, including full names, dates of birth, and medical information. The attack encrypted critical systems, leading to unauthorized access and potential exfiltration of patient records. While the exact operational disruptions remain undisclosed, the exposure of protected health information (PHI)—a highly regulated data category under HIPAA—poses severe risks, including identity theft, medical fraud, and targeted phishing scams against affected individuals. The breach underscores vulnerabilities in healthcare cybersecurity, particularly against ransomware groups exploiting weak endpoints or unpatched systems. The center likely faced regulatory scrutiny, financial penalties, and reputational damage, compounded by the need for mandatory breach notifications, credit monitoring for victims, and system overhauls to prevent recurrence. Given the nature of the stolen data (medical records), the incident falls under high-severity cyber threats to both patient privacy and organizational trust, with long-term consequences for compliance and operational continuity.