City of Hope, the covered entity (CE), reported that a workforce member was a victim of an email phishing scheme. This breach affected 3,400 individuals. The protected health information (PHI) involved in the breach included names, addresses, dates of birth, social security numbers, diagnosis, lab results, medications, and other treatment information. Following the breach, the covered entity disabled remote access to its virtual private network, including email. Additionally, OCR’s investigation resulted in the covered entity improving their security safeguards and retraining employees.
2026-09-25 · attack: unknown to hacking · backfill source
2026-09-25 · data_types: [] to ["names","health"] · backfill source
2026-09-25 · records_basis: empty to hhs · backfill source
2026-09-25 · records: empty to 3400 · backfill source
2026-09-25 · summary: empty to City of Hope, the covered entity (CE), reported that a workforce member was a victim of an email phishing scheme. This breach affected 3,400 individuals. The protected health information (PHI) involved in the breach included names, addresse · backfill source
