---
title: "Premise Health employee data misappropriation"
description: "Premise Health disclosed employee misappropriation of company data containing personal and health information."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-10"
canonical_url: "https://www.ally.security/incidents/premise-health-employee-data-misappropriation-2026"
markdown_url: "https://www.ally.security/incidents/premise-health-employee-data-misappropriation-2026.md"
stix_url: "https://www.ally.security/incidents/premise-health-employee-data-misappropriation-2026/stix.json"
---

# Premise Health employee data misappropriation

An employee’s data misuse began around March; Premise Health discovered it in September and notified people in November.

Last modified Nov 10, 2026 · 1 source

## Summary

- **Environment:** Employee access to company-held personal and health information
- **Operational impact:** Employee access revoked; affected people notified
- **Financial impact:** No confirmed incident cost quantified

## What happened

[Premise Health](https://www.premisehealth.com/) discovered on September 18 that an employee had misappropriated data beginning around March 26, 2026. Its [November 6 notice](https://oag.ca.gov/system/files/PH%20Sample%20Individual%20Notice%20Letter_0.pdf) attributes the incident to violations of company security policies. [1](#source-1)

## Impact

Affected data could include names, addresses, birth dates, government identifiers including Social Security numbers, insurance, diagnoses, treatment and service-eligibility information. No total population was stated. [1](#source-1)

## Timeline

### September 18, 2026 — Misappropriation discovered

The company revoked the employee’s access. [1](#source-1)

### October 14, 2026 — Preliminary analysis received

Further validation followed. [1](#source-1)

### November 6, 2026 — Individual notice dated

Affected people were offered identity-protection support. [1](#source-1)

### November 10, 2026 — Briefing updated

This briefing was last reviewed and updated on November 10, 2026.

## Threat Group & Attack Vector

The disclosure describes employee misuse, without specifying extraction tools. [1](#source-1)

### Actors

- Premise Health attributed the conduct to an employee whose identity was not disclosed. [1](#source-1)

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

The employee was terminated, law enforcement notified and controls strengthened. Premise Health said it was unaware of misuse of affected personal information. The sample leaves assistance duration unspecified. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/premise-health-employee-data-misappropriation-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Premise Health notice of data breach

official · Premise Health · Nov 6, 2026

<https://oag.ca.gov/system/files/PH%20Sample%20Individual%20Notice%20Letter_0.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Premise Health employee data misappropriation: Affected-person notice dated
2. **Affected Organization · 100% confidence · current**  
   Premise Health employee data misappropriation: Premise Health
3. **Discovered At · 100% confidence · current**  
   Premise Health employee data misappropriation: 2026-09-18
4. **Occurred At · 100% confidence · current**  
   Premise Health discovers employee misconduct: 2026-09-18
5. **Disclosed At · 100% confidence · current**  
   Premise Health employee data misappropriation: 2026-11-06
6. **Resulted In · 100% confidence · current**  
   Premise Health employee data misappropriation: Affected information could include names, addresses, birth dates, government identifiers including Social Security numbers, insurance, diagnosis, treatment and service-eligibility information.
7. **Occurred At · 100% confidence · current**  
   Affected-person notice dated: 2026-11-06
8. **Resulted In · 100% confidence · current**  
   Premise Health employee data misappropriation: Premise Health discovered on September 18 that an employee had violated security policies and misappropriated company data beginning on or around March 26.
9. **Occurred At · 100% confidence · current**  
   Preliminary data analysis received: 2026-10-14
10. **Resulted In · 100% confidence · current**  
   Premise Health employee data misappropriation: Preliminary data analysis received
11. **Resulted In · 100% confidence · current**  
   Premise Health employee data misappropriation: Premise Health discovers employee misconduct
12. **Resulted In · 100% confidence · current**  
   Premise Health employee data misappropriation: Premise Health revoked the employee’s credentials and access, terminated the employee, reported to law enforcement and strengthened controls; it said it was unaware of personal-information misuse.
13. **Resulted In · 100% confidence · current**  
   Premise Health employee data misappropriation: Premise Health received preliminary data analysis October 14 before further validation and November notification; its sample offers identity-protection assistance but leaves the duration unspecified.

</details>