Skip Navigation LinksDATCP Home > Data Breaches

Data Breaches

Identity Theft Links

Overview

File a Complaint

Child Credit Protection Act

Data Breaches

ID Theft Resources

ID Theft Fact Sheets

Privacy Laws

Tips for Businesses

Tips for Law Enforcement

Data breach archive (2012-2018​)

Listed below are data breaches which have either been reported to the Wisconsin Department of Agricultural, Trade and Consumer Protection (DATCP) or have been identified as affecting Wisconsin consumers.  Information is gathered on each breach and posted to this page in order to inform consumers of any services or resources that are being offered. If you are concerned about being or becoming a victim of identity theft as a result of a data breach, contact the Bureau of Consumer Protection at (800) 422-7128 or email us at datcpwisconsinprivacy@wi.gov. ​

2020 Data Breaches​

April 2020

Date Public Notified Date of Breach CompanyData Accessed
April 13, 2020March 25, 2020U.S. Small Business Administration, (SBA)Social security number, tax identification number, date of birth, ad​dress, email, phone number, marital status, citizenship status, household size, income, disclosure inquiry, financial and insurance information
Who's Affected​ ​
Details ​
7,913 affected individuals including an unknown number of Wisconsin residents. Currently there is no geographical information related to this breach. ​

On March 25, 2020, the SBA discovered their loan application website may have disclosed personally identifiable information to other applicants. The SBA disabled their website and is offering identity theft protection services to those affected.

 

ID Experts can be contacted for questions or assistance in enrolling at (833) 968-1684 or (866) 405-2133 (TTY) Monday through Friday 9:00am-9:00pm EST. The deadline to enroll is September 13, 2020.

 

If you feel you are a victim of identity theft as a result of this breach, contact the Bureau of Consumer Protection at (800) 422-7128 or email us at DATCPWisconsinPrivacy@wi.gov.

​


March 2020

Date Public Notified Date of Breach CompanyData Accessed
March 31, 2020January-February, 2020Marriott International, Inc. Name, mailing address, email address, phone number, loyalty account number and points balance, company, gender, birthday day and month, linked airline loyalty programs and numbers, stay/room preferences, and language preference.
Who's Affected ​
Details​ ​
Approximately 5.2 Million affected individuals including an unknown number of Wisconsin residents.​
​

​At the end of February 2020, Marriott identified that an unexpected amount of guest information may have been accessed using the login credentials of two employees at a franchise property. Marriott believes this activity started in mid-January 2020. Upon discovery, Marriott confirmed that the login credentials were disabled, immediately began an investigation, implemented heightened monitoring, and arranged resources to inform and assist guests.

 

On March 31, 2020, Marriott sent emails about the incident to guests involved. The email was sent from marriott@email-marriott.com.

 

Marriott has set up a self-service online portal for guests to be able to determine whether their information was involved in the incident and, if so, what categories of information were involved. This portal can be accessed through a link found at https://mysupport.marriott.com/

 

Marriott has established a dedicated call center for guests to obtain more information at: (United States/Canada) (800) 598-9655. Call center resources will be staffed 8:00am-8:00pm EDT Monday through Friday.

 

If you feel you are a victim of identity theft as a result of this breach, contact the Bureau of Consumer Protection at (800) 422-7128 or email us at DATCPWisconsinPrivacy@wi.gov.

​



Date Public Notified Date of Breac​h CompanyData Accessed
March 17, 2020
January 17, 2020Tandem Diabetes Care, Inc.Names, contact information, information related to those customers' use of Tandem's products or services, clinical data regarding diabetes therapy, and in a few limited instances, Social Security numbers.
Wh​​o's Affected​ ​
Details ​​
140,781 number of affected individuals including an unknown number of Wisconsin residents.
​

​On January 17, 2020, Tandem Diabetes Care, Inc. (Tandem) learned that an unauthorized person gained access to a Tandem employee's email account through a security incident commonly known as “phishing." Tandem immediately secured the account and a cyber-security firm was engaged to assist in the investigation. The investigation determined that a limited number of Tandem employee email accounts may have been accessed by an unauthorized user between January 17, 2020 and January 20, 2020.

 

For those individuals whose Social Security numbers were affected, Tandem is offering a complimentary membership of credit monitoring and identity protection services.

 

Tandem has established a dedicated call center for patients to call with questions, 1-844-971-0675, Monday through Friday, between 6:00 a.m. and 3:30 p.m. Pacific Time, excluding major U.S. holidays.

 

If you feel you are a victim of identity theft as a result of this breach, contact the Bureau of Consumer Protection at (800) 422-7128 or email us at DATCPWisconsinPrivacy@wi.gov.

​


February 2020

Date Public Notified

Date of Breach​

Company

Data Accessed

February 20, 2020

Approximately January 1, 2020 to January 9, 2020

Advocate Aurora Health

First and/or last name; maiden name; marital status; date of birth; street address, email address and phone number(s); date(s) of admission, discharge or treatment; social security number; medical record number; health insurance account number(s); medical device number(s); driver's license number; passport number; bank or financial account number(s); or full face photographs.

Who's Affected​ ​Details ​
Unknown number of affected individuals including an unknown number of Wisconsin residents.
​

​On or about Jan. 1, 2020, an unauthorized individual(s) used an email phishing campaign to gain access to the email credentials of several Advocate Aurora Health employees at Aurora Medical Center - Bay Area. Advocate Aurora learned of this intrusion on or about Jan. 9, 2020, and promptly initiated an internal investigation.

 

Through its investigation, Advocate Aurora confirmed that the intruder(s) did not access Advocate Aurora's or Aurora Medical Center - Bay Area's electronic health record systems. The investigation revealed that the intruder(s) may have accessed without authorization the emails of certain employees during a period from approximately Jan. 1, 2020 to Jan. 9, 2020. While Advocate Aurora cannot confirm that the intruder(s) used the email credentials to access the emails of these employees, Advocate Aurora's review of these email accounts determined that the personal and/or health information of certain Aurora Medical Center - Bay Area patients may have been included in accessible email messages.

 

Advocate Aurora is providing free credit monitoring services through Experian to affected individuals for one year.

 

Advocate Aurora can be contacted with questions at www.aah.org/patient-cybersecurity  or

(866) 242-1807.

 

If you feel you are a victim of identity theft as a result of this breach, contact the Bureau of Consumer Protection at (800) 422-7128 or email us at DATCPWisconsinPrivacy@wi.gov.

​​


2019 Data Breaches​

November 2019

Date Public NotifiedDate of Breach​CompanyData Stolen

November 22, ​2019

Early November

T-Mobile USA, Inc.

Name, billing address, phone number, account number, rate, plan, and calling features.

Who's AffectedDetails

Unknown number of affected individuals including an unknown number of Wisconsin residents.

In early November T-Mobile reported that their cybersecurity team discovered and shut down malicious unauthorized access to some information related to T-Mobile prepaid wireless accounts. T-Mobile has reported this to authorities.

The official T-Mobile statement can be found at https://www.t-mobile.com/customers/6305378822. 

If you feel you are a victim of identity theft as a result of this breach, contact the Bureau of Consumer Protection at (800) 422-7128 or email us at DATCPWisconsinPrivacy@wi.gov.​​

October 2019

Date Public NotifiedDate of BreachCompanyData Stolen

August 19, 2019

June 26 - 28, 2019

Cornerstone, Inc.

Name, address, Social Security number, date of birth, driver’s license information, and telephone number.

Who's AffectedDetails

Unknown number of affected individuals including an unknown number of Wisconsin residents.

​​​On or around July 9, 2019, Cornerstone learned that an unauthorized third party may have obtained a Cornerstone applicant’s online rental application, which contained that individual’s personal information. Cornerstone conducted an investigation and cannot rule out that an unauthorized actor may have gained access to the database which stores rental applications.

Cornerstone has identified which individuals’ information may have been affected by any potential unauthorized access and notification letters have been sent.

Cornerstone is offering potentially affected tenants and applicants complimentary credit monitoring and identity protection services for at least one year through TransUnion®.

If you have questions concerning this incident, the Cornerstone response line can be contacted at 855-683-4611, Monday through Friday, 8:00 a.m. to 8:00 p.m. Central Time. More information can also be found at https://www.rentatcornerstone.com/documents/cornerstone-data-security-2019-08-18.pdf.

If you feel you are a victim of identity theft as a result of this breach, contact the Bureau of Consumer Protection at (800) 422-7128 or email us at DATCPWisconsinPrivacy@wi.gov.

September 2019

Date Public Notified Date of Breach Company Data Stolen

September 12, 2019

September 2-12, 2019

Zynga Inc.

Name, email address, and account login information for certain players of Draw Something adn Words With Friends which may include passwords

Who's Affected Details

Approximately 200 million affected individuals includin​g an unknown number of Wisconsin residents

 ​​​On September 12, 2019, Zynga Inc. announced they recently discovered that certain player account information may have been illegally accessed by outside hackers.

Zynga has taken steps to protect certain players’ accounts from invalid logins, including but not limited to where they believe that passwords may have been accessed. Zynga has begun the process of sending individual notices to players.​

If you feel you are a victim of identity theft as a result of this breach, co​ntact the Bureau of Consumer Protection at (800) 422-7128 or email us at DATCPWisconsinPrivacy@wi.gov.​



 


 

Date Public Notified Date of Breach Company Data Stolen

September 26, 2019

May 4, 2019

DoorDash

Name, email address, delivery address, order history, phone number, as well as hashed & salted passwords.

For some consumers, the last four digits of consumer payment cards.

For some Dashers and merchants, the last four digits of their bank account number.

For approximately 100,000 Dashers, their driver’s license numbers were also accessed.​

Who's Affected Details

4.9 million consumers, Dashers, and merchants were affected including an unknown number of Wisconsin residents.

​​​DoorDash announced that earlier in September they became aware of unusual activity involving a third-party service provider. DoorDash launched an investigation and were subsequently able to determine that an unauthorized third party accessed some DoorDash user data on May 4, 2019.

Consumers, Dashers, and merchants who joined on or before April 5, 2018, are affected. Users who joined after April 5, 2018 are not affected.

DoorDash can be contacted at 855-646-4683 for 24/7 suppport

If you feel you are a victim of identity theft as a result of this breach, co​ntact the Bureau of Consumer Protection at (800) 422-7128 or email us at DATCPWisconsinPrivacy@wi.gov.​


 


 

Date Public Notified Date of Breach Company Data Stolen

September 19, 2019

February 19, 2019

CafePress, Inc.

Names, email addresses, and CafePress account passwords. For less than 1% of the affected individuals, the information also included Social Security Numbers or Tax Identification Numbers.

Who's Affected Details

Approximately 23 million affected individuals including an unknown number of Wisconsin residents.

CafePress has reported they have recently discovered that an unidentified third party obtained customer information, without authorization, that was contained in a CafePress database on or about February 19, 2019.

For CafePress account holders, it is recommended by CafePress to log in to your online account which should prompt you to change your account password.

CafePress can be contacted at: 1-844-386-9557 Monday–Friday from 9:00 a.m. to 9:00 p.m. ET or Saturday–Sunday from 11:00 a.m. to 8:00 p.m. ET.

If you feel you are a victim of identity theft as a result of this breach, contact the Bureau of Consumer Protection at (800) 422-7128 or email us at DATCPWisconsinPrivacy@Wisconsin.gov.


August 2019​

Date Public Notified Date of Breach Company Data Stolen

August 14, 2019

December 14, 2018 to July 29, 2019

Hy-Vee, Inc.

Payment card: number, expiration date, and internal verification code

Who's Affected Details

Unknown number of affected individuals including an unknown number of Wisconsin residents.

On July 29, 2019, Hy-Vee Inc. detected unauthorized activity on some of their payment processing systems. Hy-Vee conducted an investigation and found malware designed to access payment card data from cards used on point-of-sale (“POS”) devices at certain Hy-Vee fuel pumps, drive-thru coffee shops, and restaurants.

The general timeframe when data from cards used at Hy-Vee locations may have been accessed is December 14, 2018, to July 29, 2019 for fuel pumps and January 15, 2019, to July 29, 2019, for restaurants and drive-thru coffee shops.

Specific Wisconsin Hy-Vee locations and timeframes related to this incident:

Market Grille, 3801 E. Washington​, Madison, WI 53704  
January 15, 2019 - June 30, 2019

Market Grille, 675 S. Whitney Way, Madison, WI 53711​
January 15, 2019 - July 17, 2019

Hy-Vee can be contacted at (833) 967-1091 Monday through Friday between 8:00 a.m. and 8:00 p.m. CT.

If you feel you are a victim of identity theft as a result of this breach, contact the Bureau of Consumer Protection at (800) 422-7128 or email us at DATCPWisconsinPrivacy@Wisconsin.gov.


​Date Public Notified Date of Breach Company Data Stolen

August 3, 2019

May 14, 2019

StockX LLC

Name, email address, username, hashed password, address and purchase history.

Who's Affected Details

Unknown number of affected individuals including an unknown number of Wisconsin residents.

On July 26, 2019, StockX was alerted to suspicious activity potentially involving customer data. StockX launched a forensic investigation and learned an unknown third party gained unauthorized access to certain customer data on or around May 14, 2019. StockX deployed a system-wide update and implemented a full password reset of all customer passwords.

On August 3, 2019, StockX notified affected customers by email and a letter was mailed out on August 8 as a follow up to the email.

StockX is offering 12 months of fraud detection and identity theft protection from ID Experts®. StockX or ID Experts® can be contacted at (833) 300-6935 (US), +1-971-317-8411 (International), or https://ide.myidcare.c​om/stockx

If you feel you are a victim of identity theft as a result of this breach, contact the Bureau of Consumer Protection at (800) 422-7128 or email us at DATCPWisconsinPrivacy@Wisconsin.gov.


July 2019

Date Public Notified Date of Breach Company Data Stolen

July 19, 2019

March 22-23, 2019

Capital One

Name, date of birth, address, zip code, phone number, email address, credit score, credit limits, account balances, payment history, and self-reported income. In some cases Social Security number and bank account number was accessed.

Who's Affected Details

Approximately 100 million total affected individuals.

Including 140,000 individuals whose Social Security numbers were affected.

Including approximately 80,000 individuals whose bank account numbers were affected.

It is unknown how many Wisconsin residents are affected.

On July 19, 2019 Capital One announced that there was unauthorized access of its systems by an outside individual. The vulnerability was reported to the company by an external security researcher on July 17.

Capital One immediately fixed the issue and promptly began working with federal law enforcement. Capital One is reporting that The largest category of information accessed was information on consumers and small businesses as of the time they applied for a Capital One credit card product from 2005 through early 2019.

Capital One is notifying affected individuals by mail and is offering free credit monitoring and identity protection to everyone affected.

More information can be found at ​https://www.capitalone.com/facts2019/ or Capital One can be reached at 1-800-227-4825.

If you feel you are a victim of identity theft as a result of this breach, contact the Bureau of Consumer Protection at (800) 422-7128 or email us at DATCPWisconsinPrivacy@Wisconsin.gov.


June 2019

Date Public Notified Date of Breach Company Data Stolen

June 21, 2019

August 25, 2010

Dominion National

Name, Social Security number, date of birth, bank account number, bank routing number, address, email address, member ID number, group number, and subscriber number.

Who's Affected Details

Approximately 3.2 Million affected individuals including 2,964 Wisconsin residents.

On April 24, 2019, Dominion National determined that an unauthorized party may have accessed some of their computer servers. The data stored or potentially accessible from those computer servers may include enrollment and demographic information for current and former members of Dominion National and Avalon vision, and current and former members of plans Dominion National provides administrative services for.

Dominion National began notifying the potentially affected individuals on June 21, 2019. Additional information is available at www.DominionNationalFacts.com or by calling Dominion National’s incident response line at 877-503-8923 or 844-261-6819 (TTY/TDD). The incident response line is open Monday through Friday, 8:00 a.m. to 8:00 p.m. EST.

Dominion National is offering a two-year membership to ID Experts® MyIDCare™, which includes credit monitoring and fraud protection services, for any potentially affected individual.

If you feel you are a victim of identity theft as a result of this breach, contact the Bureau of Consumer Protection at (800) 422-7128 or email us at DATCPWisconsinPrivacy@Wisconsin.gov.


Date Public Notified Date of Breach Company Data Stolen

June 7, 2019

April 2, 2019

TenX Systems, LLC d/b/a ResiDex Software

Social Security numbers and medical records.

Who's Affected Details

Unknown number of affected individuals including 1,296 Wisconsin residents.

On April 9, 2019, ResiDex became aware of a data security incident, including ransomware, which impacted its server infrastructure and took its systems offline. The data security incident may have resulted in unauthorized access to protected health information, including medical records that existed on ResiDex’s software as of April 9, 2019​.

ResiDex provides software for Presbyterian Homes and Services, which has 1,296 current WI residents. ResiDex began notifying potentially impacted individuals via written notice beginning on June 7, 2019.

ResiDex is providing free membership to TransUnion, myTrueIdentity, credit monitoring service to affected individuals.

ResiDex can be contacted with questions at 877-347-0184 or 866-512-8369 between 9:00 a.m. to 9:00 p.m. Eastern Time, Monday through Friday.

If you feel you are a victim of identity theft as a result of this breach, contact the Bureau of Consumer Protection at (800) 422-7128 or email us at DATCPWisconsinPrivacy@Wisconsin.gov.


May 2019

Date Public Notified Date of Breach Company Data Stolen

May 24, 2019

October 15, 2018 through December 21, 2018

OS, Inc. on behalf of: Sauk Prairie Healthcare, Fort HealthCare, Inc., and Columbus Community Hospital.

Name, Social Security number (in the form of insurance identification numbers), hospital account number, name of insurer, summary of charges, and category of service.

Who's Affected Details
​

Unknown number of affected individuals including an unknown number of Wisconsin residents.

OS, Inc. an organization which provides claims management services to certain healthcare providers (among which is Sauk Prairie Healthcare, Fort HealthCare, Inc., and Columbus Community Hospital), announced that a phishing email campaign may have resulted in unauthorized access to personal information contained within an OS employee’s email account. On April 8, 2019, OS, Inc. notified affected hospitals that their patient's personal identifying information may have been subject to this incident.

On May 24, 2019, OS, Inc. began mailing individual notifications to each patient impacted. OS, Inc. is offering free access to Kroll’s fraud consultation and identity theft restoration services. Kroll can be contracted at (866) 775-4209, Monday through Friday from 8:00 a.m. to 5:30 p.m. with any questions.

OS, Inc. can be contacted by mail at:
PO Box 311
Pewaukee, WI 53072

Columbus Community Hospital patients may contact Andrea Link, Privacy Officer at CCH by calling (920) 623-2200 with any questions related to this incident.

Fort Healthcare patients may call (920) 568-6583 or (877) 324-2175 Monday through Friday from 8:00 a.m. to 5:00 p.m. Central Time.

Sauk Prairie Healthcare patients may call (608) 643-3311.

If you feel you are a victim of identity theft as a result of this breach, contact the Bureau of Consumer Protection at (800) 422-7128 or email us at DATCPWisconsinPrivacy@Wisconsin.gov.


Date Public Notified Date of Breach Company Data Stolen

April 22, 2019

January 2019

Inmediata Health Group, Corp.

Name, address, date of birth, gender, dates of service, diagnosis codes, procedure codes, and treating physician.

Who's Affected Details

Unknown number of affected individuals including an unknown number of Wisconsin residents.

In January 2019, Inmediata Health Group, Corp (Inmediata) became aware that some of its member patients’ electronic health information was publicly available online. When Inmediata became aware of this they immediately deactivated the publicly accessible website.

On April 22, 2019 Inmediata sent notification letters to patients who were affected by this data breach.

​Inmediata can be reached at 1-833-389-2392, Monday through Friday, 9:00am-6:30pm EST.

If you feel you are a victim of identity theft as a result of this breach, contact the Bureau of Consumer Protection at (800) 422-7128 or email us at DATCPWisconsinPrivacy@Wisconsin.gov.


April 2019

Date Public Notified Date of Breach Company Data Stolen

April 9, 2019

March 29, 2017, to January 9, 2019 and February 12-19, 2019.

Canyon Bakehouse LLC

Names, payment card numbers, expiration dates, and CVV codes.

Who's Affected Details

Approximately 12,000 individuals were notified including 295 Wisconsin residents.

On March 1, 2019 Canyon Bakehouse LLC became aware of malware installed on their systems that affected payment card data. Canyon Bakehouse LLC reported that unknown third parties gained unauthorized access to their computer systems compromising some payment card information. Canyon Bakehouse LLC has temporarily disabled the ordering and account login functions on their website until the security can be upgraded.

On April 9, 2019 Canyon Bakehouse LLC mailed notification letters to those affected and is offering one year of credit monitoring and identity theft resolution services through Experian’s IdentityWorks.

Canyon Bakehouse LLC can be reached at (970) 461-3844 ​

If you feel you are a victim of identity theft as a result of this breach, contact the Bureau of Consumer Protection at (800) 422-7128 or email us at DATCPWisconsinPrivacy@Wisconsin.gov.


January 2019

Date Public Notified Date of Breach Company Data Stolen

February 15, 2019

January 3, 2019 through January 24, 2019

North Country Business Products, Inc.

Cardholder's name, payment card number, expiration date, and CVV code.

Who's Affected Details

Unknown number of affected individuals including an unknown number of Wisconsin residents.

On January 4, 2019, North Country Business Products, Inc. learned of suspicious activity occurring within certain client networks. North Country launched an investigation and on January 30, 2019, the investigation determined that an unauthorized party was able to deploy malware to certain North Country business partners and restaurants between January 3, 2019, and January 24, 2019, that collected credit and debit card information.

North Country can be reached at 1-877-204-9537, Monday through Friday (excluding U.S. holidays), 9:00 a.m. to 9:00 p.m. EST.

North Country’s business partners located in Wisconsin:

  • Dunn Brothers Coffee of Hudson, WI (Transactions Occurring from 1/4/2019 to 1/10/2019)

  • Dunn Brothers Coffee of New Richmond, WI (Transactions Occurring on 1/4/2019)

  • Dunn Brothers Coffee of West Bend, WI (Transactions Occurring on 1/4/2019)

  • East Bay Restaurant & Bar of Holcombe, WI (Transactions Occurring on 1/4/2019)

  • Sconni’s Alehouse And Eatery of Schofield, WI (Transactions Occurring on 1/4/2019)

  • The Ranch Supper Club of Hayward, WI (Transactions Occurring on 1/4/2019)

If you feel you are a victim of identity theft as a result of this breach, contact the Bureau of Consumer Protection at (800) 422-7128 or email us at DATCPWisconsinPrivacy@Wisconsin.gov.

​