Harbor, a healthcare organization, experienced a data breach between July 25 and August 1, 2025, when an unauthorized individual accessed and exfiltrated sensitive files from its network. The compromised data varies per affected individual but includes highly sensitive information such as names, addresses, dates of birth, Social Security numbers, driver’s license/state ID numbers, medical diagnoses, treatment records, clinical data, financial account details, and health insurance information. The breach was detected on August 1, prompting an immediate investigation, law enforcement notification, and a review of internal security policies. Harbor is notifying impacted patients, employees, and board members via postal mail. The incident exposes victims to risks of identity theft, financial fraud, medical fraud, and targeted phishing attacks, given the depth of personal and health-related data stolen. The breach underscores significant vulnerabilities in Harbor’s cybersecurity infrastructure, particularly in safeguarding protected health information (PHI) and personally identifiable information (PII).