Theft
5 confirmed incidents.
VERIS: physical:Theft
Theft is a regulator reporting category, not a MITRE ATT&CK technique: it is the label used on the HHS Office for Civil Rights breach portal and similar state breach-notification forms for an incident where a physical item carrying personal data, a laptop, phone, paper file or storage device, was stolen. Unlike Loss, theft implies an intentional taking, but the source document still does not say whether the thief ever accessed the data on the device; Breach Census records the incident as reported, without inferring access the source does not state.
Top organizations
| Organization | Confirmed incidents |
|---|---|
| East Hawaii Rehab, Inc. DBA Lehua Physical Therapy and Rehab | 1 |
| Georgia Kidney Associates, Inc. | 1 |
| Renovo Chiropractic & Wellness | 1 |
| SCLARC | 1 |
| Tampa Bay Treatment Associates | 1 |
Recent incidents
| Organization | Disclosed | Jurisdiction | Records affected |
|---|---|---|---|
| Renovo Chiropractic & Wellness | March 16, 2026 | US-WA | 538 |
| Tampa Bay Treatment Associates | November 5, 2025 | US-FL | 3,682 |
| SCLARC | March 6, 2025 | US-CA | 722 |
| East Hawaii Rehab, Inc. DBA Lehua Physical Therapy and Rehab | February 28, 2025 | US-HI | 8,472 |
| Georgia Kidney Associates, Inc. | June 28, 2024 | US-GA | 9,940 |
Questions and answers
How many confirmed incidents are classified as Theft on Breach Census?
5 confirmed incidents are currently classified as Theft.
Which organization has the most confirmed Theft incidents?
East Hawaii Rehab, Inc. DBA Lehua Physical Therapy and Rehab, with 1 confirmed incidents classified this way.
Why doesn't the Theft classification map to a MITRE ATT&CK technique?
Theft is a regulator reporting category rather than an attacker technique -- it is used when a source document classifies an incident this way without specifying a technical method, so it has no MITRE ATT&CK id of its own.
What counts as a confirmed incident for the Theft classification?
An incident counts here once it carries the Theft attack-type classification and has reached the confirmed status described on the Methodology page; a bare claim or press report is not enough.