Community Research Foundation
Disclosed Jun 20, 20233 years ago31,104 affectedConfirmed
Community Research Foundation, the covered entity (CE) and business associate (BA), experienced a cyber-attack that compromised the protected health information (PHI) of 31,104 individuals. The PHI involved included names, addresses, dates of birth, Social Security and drivers’ license numbers, diagnoses, and other treatment information. The CE and BA notified HHS, affected individuals, the media, and posted substitute notice on its website. As a result of OCR’s investigation, Community Research Foundation implemented new technical safeguards, revised policies and procedures, and provided individuals with free credit monitoring.
What is known
| People affected | 31,104 (as reported to HHS) |
|---|---|
| Disclosed | Jun 20, 2023 |
| Happened | Oct 6, 2022 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Nonprofit · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Community Research Foundationoag.ca.gov · Official notice | Official notice |
| Indiana Attorney General 2023 data breach report: Community Research Foundationin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Community Research Foundation (Healthcare Provider, CA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Jun 20, 2023 | 31,104 |
| California AGresidents of CA | Jun 29, 2023 | |
| Indiana AGresidents of IN | Jun 29, 2023 | 2 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 12122 to 31104 · backfill source
- 2026-09-25 · disclosed: 2023-06-29 to 2023-06-20 · backfill source
- 2026-09-25 · summary: empty to Community Research Foundation, the covered entity (CE) and business associate (BA), experienced a cyber-attack that compromised the protected health information (PHI) of 31,104 individuals. The PHI involved included names, addresses, dates · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 12122 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.