Compassion Health Care 2025 Data Breach

CHC's official notice connects the March 17 detection, the March 21 data-scope finding, and the disclosed fields in one event. The HHS OCR entry confirms Compassion Health Care, the North Carolina healthcare provider, the May 16, 2025 report date, and the total of 23,282 people.

An independent event summary corroborates the same network incident, sequence of dates, and data categories. Because the start of unauthorized access was not publicly disclosed, March 17 is recorded as the confirmed discovery and network-interruption date, not as a claimed first-access date.

On March 17, CHC detected suspicious activity on its network and a resulting interruption. The organization began an investigation with an external cybersecurity firm to determine the nature and scope of possible unauthorized access to its systems.

On March 21, CHC learned that an unauthorized party may have viewed or downloaded data stored on certain systems. The public notice does not disclose the initial access method, technical vulnerability, first day of access, or access duration, and this record does not infer those details.

Patient records may have included names, addresses, phone numbers, dates of birth or ages, Social Security numbers, driver's license numbers, health-insurance and claims information, and clinical or diagnostic information related to medical services received.

Employee or vendor records may have included names, addresses, dates of birth, Social Security numbers, income information, financial-account information, and possibly bank-account and routing numbers. The notice does not say every field applied to every person; email addresses, passwords, and payment cards are excluded because they were not confirmed.

Social Security, driver's license, and bank information can support identity theft, fraudulent accounts, unauthorized transfers, or tax fraud. Some of these identifiers are difficult to change, making long-term credit and account monitoring appropriate.

Health-insurance, claims, and clinical details may help an attacker create convincing messages that refer to a real service. Knowing accurate health information does not prove that a sender represents CHC, a physician, a bank, or an insurer.

CHC investigated the event with external cybersecurity specialists and sent written notices to potentially affected patients, employees, and vendors on May 16, 2025. The organization also established a dedicated assistance line for questions about the event.

Potentially affected individuals were offered complimentary credit monitoring and identity-theft restoration services. The official notice does not state a definitive conclusion that misuse did or did not occur; the protective measures are intended to reduce possible risk.

Notice recipients should regularly review credit reports, bank and financial accounts, health-insurance explanations, and tax records for accounts, transactions, services, or claims they do not recognize. Suspicious entries should be reported promptly to the relevant institution.

Do not share a Social Security number, banking information, health data, password, or one-time verification code in response to an unexpected email, message, or call. A request claiming to come from CHC should be verified using contact details on the organization's official website rather than links or numbers in the message.