Santa Cruz Community Health

Disclosed Jan 12, 20261,487 affectedConfirmed

The covered entity (CE), Santa Cruz Community Health, reported that a subcontractor of its business associate (BA) experienced a cyber-attack that compromised the protected health information (PHI) of 1,487 individuals. The PHI involved demographic, clinical, and financial information. The CE notified HHS, affected individuals, the media, and published substitute notice. The subcontractor notified law enforcement. The CE provided free credit monitoring to the affected individuals and has implemented new technical safeguards. OCR provided technical assistance regarding the HIPAA Breach Notification Rule.

What is known

People affected	1,487 (as reported to HHS)
Disclosed	Jan 12, 2026
Happened	Nov 1, 2024
Attack	Hacking
Data exposed	NamesHealth
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Santa Cruz Community Health

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): Santa Cruz Community Health (Healthcare Provider, CA)

Notices filed

TotalJan 12

HHS archive1,487 people

Residents of CAJan 16

California AGCount not stated

History of this record

attack2026-09-25

unknown to hackingby backfillSource

data_types2026-09-25

[] to ["names","health"]by backfillSource

records_basis2026-09-25

empty to hhsby backfillSource

records2026-09-25

empty to 1487by backfillSource

disclosed2026-09-25

2026-01-16 to 2026-01-12by backfillSource

summary2026-09-25

empty to The covered entity (CE), Santa Cruz Community Health, reported that a subcontractor of its business associate (BA) experienced a cyber-attack that compromised the protected health information (PHI) of 1,487 individuals. The PHI involved demby backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Santa Cruz Community Health