Where does the HealthEquity, Inc. case file come from?

Every entry is taken from the breach report HealthEquity, Inc. lodged with the California Attorney General. Nothing here is estimated.

Why do the incident date and the report date differ?

Companies usually investigate before they report. The gap between the two dates shows how long that took.

What does the records-affected figure count?

It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.

Does this case file change over time?

Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

Case file

Case File: HealthEquity, Inc. Data Breach

This file collects the dated facts on record for the HealthEquity, Inc. incident. The state report is dated March 21, 2025. The incident itself is dated March 9, 2024.

Timeline

377 days separate the incident date from the date it was reported.

March 9, 2024Incident dateWhen the filing says the breach took place.
March 21, 2025Report filed in CaliforniaDate the notice was lodged with the California Attorney General.

Case facts

Filing state: California
Date reported: March 21, 2025
Incident date: March 9, 2024
Receiving office: California Attorney General

Case notes

HealthEquity, Inc., a company based in CA, has confirmed a data security incident that affected personal information. The incident is reported to have occurred on March 9, 2024, with the company officially filing notice with regulators on March 21, 2025.

The specific type of security breach involved, as well as the categories of personal information that may have been exposed, were not detailed in the public filings. The number of individuals potentially affected by this incident also remains unspecified in the available records.

According to HealthEquity's reporting, the incident is currently under investigation. This information is derived from public records filed with state regulators, which serve to inform individuals and provide transparency regarding such events.

Individuals who receive a direct notification from HealthEquity should review the letter carefully for any specific details pertinent to their situation. As a general precaution, it is advisable to remain vigilant against unexpected communications and to monitor personal accounts for any unusual or unauthorized activity.

Questions about this case file

Where does the HealthEquity, Inc. case file come from?: Every entry is taken from the breach report HealthEquity, Inc. lodged with the California Attorney General. Nothing here is estimated.
Why do the incident date and the report date differ?: Companies usually investigate before they report. The gap between the two dates shows how long that took.
What does the records-affected figure count?: It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.
Does this case file change over time?: Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

California data breaches

Filing source: California Attorney General

Named in the HealthEquity, Inc. breach?

Attach your notice and a short note. An attorney checks it against this case file at no cost.

Timeline

Case facts

Case notes

Questions about this case file

More California case files