Center for Urban Community Services
Disclosed Jan 24, 20242 years ago38,000 affectedConfirmed
The business associate (BA) reported that it experienced a cyberattack that compromised the protected health information (PHI) of 38,000 individuals. The PHI affected included names, dates of birth, drivers’ license and Social Security numbers, financial information, diagnoses/conditions, lab results, medications, and other treatment information. In response to the breach, the BA implemented additional administrative and technical safeguards.
What is known
| People affected | 38,000 (as reported to HHS) |
|---|---|
| Disclosed | Jan 24, 2024 |
| Happened | Sep 4, 2023 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Vermont Attorney General: 2024-07-03 Center for Urban Community Services Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Vermont Attorney General: 2024-01-24 Center for Urban Community Services Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Indiana Attorney General 2024 data breach report: Center for Urban Community Servicesin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Center for Urban Community Services (Business Associate, NY)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Vermont AGresidents of VT | Jan 24, 2024 | |
| Indiana AGresidents of IN | Jan 24, 2024 | 10 |
| Vermont AGresidents of VT | Jul 3, 2024 | |
| HHS archivetotal | Oct 11, 2024 | 38,000 |
History of this record
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 2266 to 38000 · backfill source
- 2026-09-25 · summary: empty to The business associate (BA) reported that it experienced a cyberattack that compromised the protected health information (PHI) of 38,000 individuals. The PHI affected included names, dates of birth, drivers’ license and Social Security numb · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 2266 · backfill source
- 2026-09-25 · occurred: empty to 2023-09-04 · backfill source
- 2026-09-25 · disclosed: 2024-07-03 to 2024-01-24 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Vermont AG), confirmed by Vermont AG. Record counts are as reported. Not legal advice.