Boston Health Care for the Homeless Program data breach: patients' and staff data, letters nine months on

What happened at BHCHP?

BHCHP says it investigated with cybersecurity experts and found that some files may have been accessed or acquired without authorization. A review of those files then showed, on or about June 8, 2026, whose information they held. It says it has no evidence of misuse.

Date	What the letter and the regulators' records say
October 31, 2025	Breach date on the California and Indiana records
November 11, 2025	BHCHP first learns of a network disruption
June 8, 2026	BHCHP finds that personal information was in the affected files
August 7, 2026	Letter date; Indiana notice date
August 8, 2026	Logged in Massachusetts (184,914)
August 10, 2026	Report to HHS (201,260); posted by Texas (553)

Letters went out 269 days after BHCHP learned of the disruption, and 60 days after it found that personal information was involved. The guide to notice delays compares that with the rest of the log.

What information was involved?

The letter fills in each reader's items after the name. The state records give the categories:

Regulator	Information it records
Texas attorney general	Name; Social Security number; medical information; health insurance information
Massachusetts consumer affairs office	Social Security numbers, medical records and driver's licenses marked as breached; financial accounts and payment cards not

Why did I get a letter from Boston Health Care for the Homeless Program?

The letter says the information belongs to some of the program's patients or employees. Not everyone written to lives in Massachusetts: Texas counts 553 Texans and Indiana 124 Indiana residents.

How many people were affected?

Regulator	What it counts	Number
HHS Office for Civil Rights	Individuals affected	201,260
Indiana attorney general	Total affected	201,260
Massachusetts consumer affairs office	Massachusetts residents	184,914
Texas attorney general	Texans	553
Indiana attorney general	Indiana residents	124

What is BHCHP offering?

Twenty-four months of single-bureau credit monitoring, a credit report and a credit score from Cyberscout, a TransUnion company, with fraud assistance. People must enroll within 90 days of the letter.

Item	Detail from the letter
Provider	Cyberscout (TransUnion)
Length	24 months
Enrollment	bfs.cyberscout.com/activate, within 90 days of August 7, 2026
Questions	1-866-898-9670, Monday to Friday, 8:00 a.m. to 8:00 p.m. Eastern, excluding holidays
Postal address	780 Albany Street, Boston, MA 02118

Enrolling needs an internet connection and an email account, the letter says. People without either can call the number above. The guide to healthcare provider breach notices compares other clinics' letters.

What the documents leave open

• What caused the network disruption, and how the intruder got in.
• Why seven months passed between the disruption and the finding that personal data was involved.
• How many of those affected are patients and how many are employees.