3500 patients were affected by this incident, according to Sunshine Behavioural Health's notification to HHS. Additionally, the box for business associate was checked. It was discovered that a mistake had given some people receiving treatment for drug or alcohol addiction's personal and financial information away. Someone who shared the leaked data with DataBreaches.net in August found the leak. This blogger called Sunshine Behavioural Health on September 4 to inform them of the leaked data after confirming that the data had been made public. Full name, date of birth, postal and email addresses, telephone numbers, full credit card numbers with expiration dates (month/year), full CVV code, health insurance membership number, account number, statements regarding insurance benefits, and amounts due and paid were among the patient information types that were discovered in the files.

The California Office of the Attorney General reported a data breach involving Sunshine Behavioral Health Group, LLC on January 21, 2020. The breach, which occurred on March 1, 2017, involved unauthorized access to personal information stored in a cloud-based system, including contact details, credit/debit card numbers, and electronic signatures. Approximately 500 individuals were affected by this incident.