Catholic Charities CYO of The Archdiocese of San Francisco
Disclosed Mar 29, 20242 years ago7,486 affectedConfirmed
The covered entity (CE), Catholic Charities CYO of The Archdiocese of San Francisco, reported that it experienced a cyberattack that compromised the protected health information (PHI) of 7,486 individuals. The PHI involved included names, addresses, dates of birth, drivers’ license and Social Security numbers, financial information, diagnoses and conditions, medications, and other treatment information. The CE notified HHS, affected individuals, and the media. In response to the breach the CE implemented additional technical safeguards to better protect its PHI.
What is known
| People affected | 7,486 (as reported to HHS) |
|---|---|
| Disclosed | Mar 29, 2024 |
| Happened | Sep 13, 2023 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Catholic Charities CYO of The Archdiocese of San Franciscooag.ca.gov · Official notice | Official notice |
| Vermont Attorney General: 2024-08-30 Catholic Charities CYO of The Archdiocese of San Francisco Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Vermont Attorney General: 2024-03-29 Catholic Charities CYO of The Archdiocese of San Francisco Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Catholic Charities CYO of The Archdiocese of San Francisco (Healthcare Provider, CA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Mar 29, 2024 | |
| Vermont AGresidents of VT | Mar 29, 2024 | |
| California AGresidents of CA | Aug 30, 2024 | |
| Vermont AGresidents of VT | Aug 30, 2024 | |
| HHS archivetotal | Aug 30, 2024 | 7,486 |
History of this record
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 7486 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Catholic Charities CYO of The Archdiocese of San Francisco, reported that it experienced a cyberattack that compromised the protected health information (PHI) of 7,486 individuals. The PHI involved included names, a · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2024-03-29-catholic-charities-cyo-archdiocese-san-francisco-data-breach-notice-consumers · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2024-08-30-catholic-charities-cyo-archdiocese-san-francisco-data-breach-notice-consumers · backfill source
- 2026-09-25 · disclosed: 2024-08-30 to 2024-03-29 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.
Everything about Catholic Charities CYO of The Archdiocese of San Francisco