Imperial Beach Community Clinic Hit by Prolonged Data Breach Affecting Patients and Staff Imperial Beach Community Clinic (IB Clinic), a San Diego-based healthcare provider, disclosed a data breach involving unauthorized access to its email systems, potentially exposing sensitive information. The incident was reported to the California Attorney General on January 6, 2026, following an investigation into suspicious activity detected on April 15, 2025. The breach occurred over a three-month period, from February 4 to May 2, 2025, during which an unauthorized individual may have accessed and copied data within the clinic’s email environment. While the exact types of exposed information remain unspecified, the clinic completed its review of affected individuals on December 30, 2025. In response, IB Clinic secured its systems, engaged cybersecurity and legal experts, and began notifying potentially impacted patients and staff—despite no evidence of data misuse. As a precaution, the clinic is offering 12 months of complimentary credit monitoring, reports, and scores through Cyberscout (a TransUnion company), with enrollment required within 90 days of notification. Affected individuals may also place fraud alerts or security freezes on their credit files. A dedicated assistance line (833-543-5741) has been established for inquiries, operating Monday through Friday, 8 a.m. to 8 p.m. ET. The clinic continues to assess the full scope of the incident.

Imperial Beach Community Clinic and Valley Eye Associates Hit by Separate Cybersecurity Incidents Two healthcare providers Imperial Beach Community Clinic (California) and Valley Eye Associates (Wisconsin) have reported significant cybersecurity breaches, exposing sensitive patient data. ### Imperial Beach Community Clinic Email Breach On April 15, 2025, Imperial Beach Community Clinic detected unusual activity in its email environment. An investigation revealed that an unauthorized individual had accessed certain email accounts between February 4 and May 2, 2025, potentially compromising patient information. The exposed data included: - Names, dates of birth, and ages - Insurance details and claim numbers - Appointment and service dates - Provider and procedure information The clinic concluded its file review on December 30, 2025, and has since strengthened its data privacy and security policies. However, the breach has not yet appeared on the HHS’ Office for Civil Rights (OCR) breach portal, and the number of affected individuals remains undisclosed. ### Valley Eye Associates Ransomware Attack Valley Eye Associates, an ophthalmology and optometry center in Appleton, Wisconsin, confirmed a ransomware attack on October 8, 2025. Cybersecurity experts determined that attackers accessed its network for less than 48 hours, exfiltrating 139 GB of data. The Qilin ransomware group claimed responsibility and published the stolen data after the ransom went unpaid. While the clinic stated there is no evidence of misuse, the breach notice did not explain how this determination was made. Valley Eye Associates has since implemented additional security measures, particularly for its email systems, which were likely the initial attack vector. ### HIPAA Compliance and Broader Implications Both incidents highlight persistent vulnerabilities in healthcare cybersecurity, particularly phishing attacks and ransomware. The breaches underscore the importance of: - Ongoing security awareness training for staff to detect threats - Strict access controls, including unique login credentials - Timely breach notifications to affected individuals - Regular policy reviews to adapt to evolving threats While Imperial Beach Community Clinic has not disclosed the full impact, Valley Eye Associates continues to review affected data before notifying patients. These cases serve as a reminder of the high-value targets healthcare records present to cybercriminals and the critical need for robust HIPAA compliance measures.