University of Central Arkansas Community Care Clinic

Summary

The University of Central Arkansas Community Care Clinic disclosed that an unauthorized third party accessed one of its IT systems and obtained a file containing email addresses. Medical records, credit card information, and financial account numbers were not involved, though the exposure may have led to phishing emails or fraudulent messages designed to steal sensitive information. The clinic reported the incident to the U.S. Department of Health and Human Services, secured its systems, removed unauthorized access, and enhanced network security controls, monitoring, and access protocols. Staff also completed specialized cybersecurity awareness retraining. The clinic, which provides primary care, mental health counseling, physical and occupational therapy, and other services to central Arkansas residents while serving as a training facility for health-related degree students, stated that the cause and method of access remained unclear.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

The University of Central Arkansas disclosed on October 29, 2026, that its Community Care Clinic experienced a data breach in September. Unauthorized activity was discovered in the clinic's computer systems on September 28. A subsequent investigation determined that an unauthorized third party had access to one of the clinic's IT systems between September 4 and September 28. The clinic discovered on September 28 and confirmed on September 29 that a file containing email addresses had been accessed or acquired. The number of exposed email addresses was not disclosed. Medical records, credit card information, and financial account numbers were not involved in the breach. The clinic is located on the University of Central Arkansas campus in Conway and provides primary care, mental health counseling, physical and occupational therapy, among other services, to central Arkansas residents. It is overseen by the university and serves as a training facility for students pursuing health-related degrees.

The clinic warned that the incident may have resulted in recipients receiving phishing emails, fraudulent messages designed to trick people into revealing sensitive information such as passwords or financial details, or clicking malicious links. University officials stated that they deeply regret the incident. The clinic notified the U.S. Department of Health and Human Services as required by law. The cause of the breach and how the unauthorized party gained access to the clinic's systems remained unclear as of the disclosure date. University officials did not immediately respond to requests for comment. In response, the clinic secured its systems, removed unauthorized access, and enhanced its network security controls, monitoring capabilities, and access protocols. Staff members underwent specialized cybersecurity awareness retraining. The clinic encouraged recipients to change their email account passwords and remain vigilant for potential phishing attempts. Anyone seeking additional information or who believes they may be impacted was asked to contact the Community Care Clinic.

Sources

Sources available to members: 1 source.