Community Health Center breach exposed data on more than 1 million patients

Community Health Center, Inc., a nonprofit primary care provider headquartered in Middletown, Connecticut, disclosed in early 2025 that an intruder had reached its network and copied patient data. The organisation said it detected unusual activity on January 2, 2025, cut off the attacker's access within hours, and brought in outside cybersecurity specialists to establish what had been taken.

The investigation found the intrusion began around October 14, 2024 and went undetected for close to three months. Community Health Center reported the incident as affecting 1,060,936 people. GovTech reported that those affected lived across eight states: Connecticut, Maine, Massachusetts, Rhode Island, Vermont, New York, Oregon and North Carolina.

The data involved varied by individual and included names, addresses, telephone numbers, email addresses, dates of birth, diagnoses, test results, treatment information, health insurance details and Social Security numbers. Pediatric patients and their parents or guardians were among those notified, as were people who had only received COVID-19 testing or vaccination at the provider's sites.

No files were encrypted and no data was deleted, so clinical operations continued without interruption. Community Health Center said it had added monitoring software and other safeguards, and offered those affected free identity theft protection, including 24 months of credit monitoring for people whose Social Security or taxpayer identification numbers were involved. No ransomware group publicly claimed the intrusion, and the Connecticut Attorney General's office advised residents to freeze their credit.