CalViva Health suffered a significant data breach stemming from a cyber attack on its third-party vendor, Accellion, between January 7–25, 2021. The incident exposed sensitive personal information of approximately 1,000,000 individuals, including names, addresses, dates of birth, insurance ID numbers, and health records. The breach occurred due to vulnerabilities exploited in Accellion’s file-transfer system, leading to unauthorized access and potential exfiltration of protected health data. While the attack targeted a vendor, the repercussions directly impacted CalViva Health’s customers, raising concerns over identity theft, financial fraud, and misuse of medical information. The scale of the breach—affecting a vast number of individuals—highlights systemic risks in third-party dependencies and the critical need for robust cybersecurity measures in healthcare sectors handling highly sensitive data.