HealthEquity, Inc.

Organization

HealthEquity, Inc.

Source

California AG · source record

Date reported

Apr 17, 2025

Date(s) of breach

Saturday, March 9, 2024

Residents affected

Not published by this source

Data exposed

Social Security number Financial / bank account Medical / health information Phone number Postal address Name

Notice letter

Sample notice (PDF)

Discovered

Mar 25, 2024, as stated in the letter

"After receiving an alert, on March 25, 2024, HealthEquity became aware of a systems anomaly requiring extensive technical investigation and ultimately resulting in data forensics until June 10, 2024."

Days to notice

388 days from discovery (Mar 25, 2024) to the California record (Apr 17, 2025). Statute: 30 days from discovery or notification of the breach (Cal. Civ. Code § 1798.82). Over the statutory period

Offered in the letter

24 months of credit or identity monitoring through Experian

Third party

The letter attributes the incident to a vendor or service provider

First seen by BreachTally

2026-10-30 15:30 UTC

Dates and counts as filed by the organization with the agency. The breach window and the report date often differ by months.