People's Community Clinic
Disclosed Dec 19, 20259 months ago700,000 affectedConfirmed
The covered entity (CE), People’s Community Clinic, reported that a subcontractor of its business associate (BA) experienced a cyberattack that compromised the protected health information (PHI) of 1,788 of the CE’s patients. The PHI involved clinical and demographic information. The CE notified HHS, affected individuals, and published notice on its website, and the subcontractor also notified individuals, the media, and HHS on the CE’s behalf. OCR provided technical assistance to the CE about business associate agreements and the requirements of the HIPAA Breach Notification Rule.
What is known
| People affected | 700,000 (as reported by the organization) |
|---|---|
| Disclosed | Dec 19, 2025 |
| Discovered | Dec 12, 2025 |
| Happened | Nov 1, 2024 |
| Attack | Hacking |
| Data exposed | Social Security numbers, Health, Insurance, Dates of birth, Addresses, Names |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Texas Attorney General data security breach report BR-0004898: People's Community Clinicoag.my.site.com · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): People's Community Clinic (Healthcare Provider, TX)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Texas AGresidents of TX | Dec 19, 2025 | 1,788 |
| HHS archivetotal | Dec 23, 2025 | 1,788 |
| Texas AGresidents of TX | Mar 12 | 1,788 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), People’s Community Clinic, reported that a subcontractor of its business associate (BA) experienced a cyberattack that compromised the protected health information (PHI) of 1,788 of the CE’s patients. The PHI involv · backfill source
- 2026-09-25 · disclosed: 2026-03-12 to 2025-12-19 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Texas AG), confirmed by Texas AG. Record counts are as reported. Not legal advice.