Erie Family Health Centers

Summary

Erie Family Health Centers detected a hacker attack that led to unauthorized access to its network. The investigation indicated that the intrusion persisted for several weeks before being contained. Exposed data included names, phone numbers, email addresses, SSNs, driver’s license numbers, passport numbers, online account credentials, financial and medical information, affecting approximately 570,000 individuals.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Erie Family Health Centers in Chicago, Illinois, detected a hacker attack in January 2026. A probe was conducted after the detection. The probe revealed that threat actors had gained access to the center’s network starting on December 10, 2025. The unauthorized access persisted until late January 2026, when the breach was identified. The breach was subsequently added to the U.S. Department of Health and Human Services breach tracker. No public disclosure of the exact detection date was provided beyond the month of January.

The compromised data included a range of personal identifiers and sensitive information. Specifically, attackers obtained names, phone numbers, and email addresses of patients. In addition, Social Security numbers, driver’s license numbers, and passport numbers were exposed. Online account credentials, financial information, and medical records were also part of the data set that was accessed. The compromised information encompassed both identity-related data and health-related data. According to the HHS tracker, the breach affected approximately 570,000 individuals. This figure reflects the total number of unique persons whose data was present in the compromised systems.

Erie Family Health Centers’ incident was one of several healthcare breaches reported to the HHS tracker in early 2026. Other organizations noted in the same period included the New York City Health and Hospitals Corporation, Florida Physician Specialists, Coastal Carolina Health Care, Western Orthopaedics, and Nacogdoches Memorial Hospital. Like the other breaches described in the article, the Erie incident was not claimed by any known cybercrime group. The breach contributed to the overall count of individuals impacted across the U.S. healthcare sector during that timeframe.

Sources

Sources available to members: 1 source.