Community Health Center of Buffalo Data Breach: What Patients Need to Know

According to the health center’s online notice, Community Health Center of Buffalo identified suspicious activity within its computer network on April 21, 2026. With the assistance of digital forensic and cybersecurity experts, the investigation confirmed that an unauthorized actor accessed the network on April 20 and April 21, 2026, retrieving files without authorization.

The center reported that it was reviewing the data involved and would send written notices to potentially affected individuals. The breach was reported to the U.S. Department of Health and Human Services’ Office for Civil Rights on June 19, 2026, and CHCB posted a notice about the security incident on its website. Notification letters were reported to include an offer of complimentary credit monitoring and identity theft protection services.

According to reporting on the incident, information believed to be impacted included personal information such as names, addresses, dates of birth, Social Security numbers, and driver’s license numbers. Protected health information that may have been exposed reportedly included prescription information, treatment location and information, medical diagnoses and conditions, lab results, medications, medical record numbers, provider names, patient medical history, and health insurance policy information and identification numbers.

This is a broad and sensitive combination of financial identifiers and detailed medical data. When Social Security numbers and medical records are exposed together, affected individuals may face risks of both financial and medical identity theft, which is why prompt enrollment in any offered monitoring is advisable.

Because the intrusion involved CHCB’s own network, affected individuals are primarily patients whose information the health center maintained. Community health centers serve many patients who rely on them for essential care, which makes the protection of their data particularly important.

The health center indicated it was reviewing the affected files to determine the types of data involved and the specific individuals affected. If you are a current or former CHCB patient, receiving a notification letter is a signal to take protective steps and to understand your options promptly.

Enroll in the complimentary credit monitoring and identity theft protection offered in your notice, and keep the letter for your records. Monitor your financial accounts and review Explanations of Benefits from your health insurer for services you did not receive, which can indicate medical identity theft.

You may also consider placing a fraud alert or credit freeze and remaining alert to phishing attempts referencing CHCB or the breach. Beyond these steps, a legal professional can help you understand whether you may be entitled to compensation.