Colorado Health Network Confirms Data Breach Exposing Sensitive Patient Information Colorado Health Network (CHN), a provider of holistic support services for individuals with HIV, has confirmed a data breach involving unauthorized access to its systems. The incident, disclosed following an investigation, revealed that an unauthorized actor accessed and exfiltrated files containing highly sensitive information. Affected data may include names, Social Security numbers, driver’s license or state ID numbers, passport details, financial account information, credit or debit card numbers, medical records, and health insurance data. The breach was first flagged on August 28, 2025, when the ransomware group Cephalus claimed responsibility, alleging the theft of over 900 GB of data from CHN. Notifications to impacted individuals began on June 18, 2026. Legal representatives are now investigating the possibility of a class action lawsuit on behalf of those affected, seeking compensation for privacy violations, financial losses, and other damages. The breach underscores ongoing vulnerabilities in healthcare data security, particularly for organizations handling sensitive patient information.

Colorado Health Network Discloses Massive Data Breach Exposing Sensitive Patient Information Colorado Health Network Inc., a Denver-based nonprofit providing medical care and support services to individuals with HIV/AIDS and other health conditions, has reported a significant data breach involving highly sensitive personal and health information. While the exact number of affected individuals remains undisclosed, the incident exposed a vast range of data, including names, addresses, Social Security numbers, government-issued IDs, financial details, and medical records such as diagnoses, prescriptions, and treatment codes. The breach came to light after a threat actor known as Cephalus claimed responsibility on August 28, 2025, posting on the Tor network and alleging the theft of over 900 GB of data from the organization. Colorado Health Network formally disclosed the incident to the Massachusetts Office of Consumer Affairs and Business Regulation on June 22, 2026, and published a notice on its website. In response, the organization is offering affected individuals a complimentary 24-month membership to identity monitoring services through Epiq’s Privacy Solutions ID program. A dedicated helpline (1-866-659-7097) has been established for inquiries, with additional support available for enrollment in the monitoring service. The breach underscores the growing risks to healthcare data, particularly for vulnerable populations reliant on specialized care providers.