City of McKinney
Disclosed Feb 3, 20251 year ago17,751 affectedConfirmed
City of McKinney, the covered entity (CE) reported that it experienced a ransomware incident that affected the protected health information (PHI) of 17,751 individuals. The PHI involved included demographic, clinical, and financial information. The CE notified HHS, affected individuals, and the media. In response to the breach and OCR’s investigation, the CE revised its policies and procedures, implemented additional technical safeguards and retrained its workforce members.
What is known
| People affected | 17,751 (as reported by the organization) |
|---|---|
| Disclosed | Feb 3, 2025 |
| Happened | Oct 31, 2024 |
| Attack | Insider |
| Data exposed | Names, Health |
| Sector | Government · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Vermont Attorney General: 2025-02-04 City of McKinney Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Indiana Attorney General 2025 data breach report: City of McKinneyin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): City of McKinney (Health Plan, TX)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Feb 3, 2025 | 17,751 |
| Vermont AGresidents of VT | Feb 4, 2025 | |
| Indiana AGresidents of IN | Feb 4, 2025 | 2 |
History of this record
- 2026-09-25 · attack: unknown to insider · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · disclosed: 2025-02-04 to 2025-02-03 · backfill source
- 2026-09-25 · summary: empty to City of McKinney, the covered entity (CE) reported that it experienced a ransomware incident that affected the protected health information (PHI) of 17,751 individuals. The PHI involved included demographic, clinical, and financial informat · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 17751 · backfill source
- 2026-09-25 · occurred: empty to 2024-10-31 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Vermont AG), confirmed by Vermont AG. Record counts are as reported. Not legal advice.