Coastal Carolina Health Care 2025 Data Breach

The primary evidence is a March 24, 2026 notification sent to the New Hampshire Attorney General by counsel for Coastal Carolina Health Care. It says CCHC identified unusual activity disrupting access to certain systems on March 28, 2025 and opened an investigation with an independent cybersecurity firm. The review found not merely possible access but that certain information had been accessed and acquired without authorization.

The HHS OCR row lists the organization as a Healthcare Provider, categorizes the event as a Hacking/IT Incident, and identifies Network Server as the information location. Its total of 110,304 people supplies the regulatory scope not stated nationally in the state letter. SecurityWeek independently reported the CCHC event by comparing the HHS total and state filing.

The investigation found that an unknown actor accessed and acquired personal and health information between March 21 and March 27, 2025. The incident date is based on the earliest technical activity that can be verified from public sources. CCHC noticed the unusual activity on March 28, secured its network, and began a forensic investigation to determine the nature of the event.

The organization then used a third-party review service to identify the affected data set and notice population. CCHC confirmed the scope of impact and obtained sufficient contact information on February 26, 2026. Consumer letters were mailed on March 23, 2026; the roughly one-year interval represents file and identity review, not the duration of the actor's access.

The regulatory correspondence describes the affected data as personal information and protected health information. For New Hampshire residents, it expressly says names may have appeared with Social security numbers. CCHC also offered dedicated identity-protection services to people whose Social security numbers or driver's-license and state identification numbers were affected.

Unverified person counts, data fields, and threat-actor claims are not treated as part of the public incident scope. It also does not assume that every field was present for all 110,304 people.

The official text says sensitive information was accessed and acquired, not merely that it might have been seen. That finding provides strong forensic support that data could enter the actor's control and distinguishes the event from a simple system outage. The filing does not, however, confirm that files were publicly released or that all fields were sold.

At notification, CCHC said it had no evidence that data involved in the incident had been misused. A lack of known misuse does not eliminate future risks associated with acquired identity and health information. Unverified person counts, data fields, and threat-actor claims are not treated as part of the public incident scope.

The affected-person or record count published by the official source represents the reported scope of the incident. It does not mean that every disclosed data category applied to every person. The 34 New Hampshire residents in the state regulatory letter are a small state subset of that national total, not a separate incident or an additional victim count. The subset is not added to the national number.

The person total is not a count of acquired files or data fields. Social Security, driver's-license, and state identification numbers may apply only to relevant subgroups, whose sizes were not publicly disclosed.

CCHC offered people whose Social Security or driver's-license and state identification numbers were affected 12 months of complimentary credit monitoring, identity restoration, and identity-theft insurance through Cyberscout. Notice recipients should follow the deadline and activation instructions in their letter. The organization also notified the FBI and implemented additional security controls.

Credit reports, financial accounts, and health-insurance explanations of benefits should be checked regularly for unfamiliar transactions, services, or claims. Unexpected payment or verification messages presented in the name of CCHC or a healthcare provider should be confirmed through a known official channel.