Community Research Foundation

Disclosed Jun 20, 202331,104 affectedConfirmed

Community Research Foundation, the covered entity (CE) and business associate (BA), experienced a cyber-attack that compromised the protected health information (PHI) of 31,104 individuals. The PHI involved included names, addresses, dates of birth, Social Security and drivers’ license numbers, diagnoses, and other treatment information. The CE and BA notified HHS, affected individuals, the media, and posted substitute notice on its website. As a result of OCR’s investigation, Community Research Foundation implemented new technical safeguards, revised policies and procedures, and provided individuals with free credit monitoring.

What is known

People affected	31,104 (as reported to HHS)
Disclosed	Jun 20, 2023
Happened	Oct 6, 2022
Attack	Hacking
Data exposed	NamesHealth
Sector	Nonprofit · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Community Research Foundation

Official noticein.gov

Indiana Attorney General 2023 data breach report: Community Research Foundation

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): Community Research Foundation (Healthcare Provider, CA)

Notices filed

TotalJun 20, 2023

HHS archive31,104 people

Residents of CAJun 29, 2023

California AGCount not stated

Residents of INJun 29, 2023

Indiana AG2 people

History of this record

attack2026-09-25

unknown to hackingby backfillSource

data_types2026-09-25

[] to ["names","health"]by backfillSource

records_basis2026-09-25

organization to hhsby backfillSource

records2026-09-25

12122 to 31104by backfillSource

disclosed2026-09-25

2023-06-29 to 2023-06-20by backfillSource

summary2026-09-25

empty to Community Research Foundation, the covered entity (CE) and business associate (BA), experienced a cyber-attack that compromised the protected health information (PHI) of 31,104 individuals. The PHI involved included names, addresses, dates by backfillSource

records_basis2026-09-25

empty to organizationby backfillSource

records2026-09-25

empty to 12122by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Community Research Foundation