Colorado Health Network data breach: 68,212 people's medical and ID data taken from the HIV services nonprofit

What happened at Colorado Health Network?

The notice is short on dates. It says the organization found unauthorized access to some of its systems, secured them and hired a cybersecurity firm, and that the investigation found an unauthorized individual had viewed and obtained certain files on its network. It does not say when the access happened, when it was found, or how the intruder got in. The HIPAA Journal made the same point: the notice gives no detection date and no length of access. The only breach date in the record checked here is Indiana's, July 29, 2025.

Date	What happened	Source
July 29, 2025	Breach date in Indiana's record	Indiana report
June 18, 2026	Letters begin	CHN notice; Indiana report

If July 29, 2025 is when the intrusion started, the letters came 324 days later. The notice-delay guide shows how that compares.

What information was exposed in the Colorado Health Network breach?

The files held names together with one or more of: Social Security number, driver's license or state ID number, passport number, financial account information, debit or credit card information, medical information and health insurance information. The notice spells out that medical information includes diagnosis, diagnosis code, mental or physical condition, prescription information and the provider's name and location, and that insurance information includes beneficiary and subscriber numbers and Medicaid or Medicare identification. The organization says it has had no reports or evidence of fraud or identity theft from the incident.

Why is this breach more sensitive than most?

Because of who the organization serves. Colorado Health Network's own site asks visitors to support those living with HIV in Colorado, and The HIPAA Journal describes it as a nonprofit providing health and support services to people with HIV/AIDS across the state. A diagnosis or prescription record held by an HIV services provider can point to a person's HIV status even when the letter does not name the condition. Health data like this cannot be reissued the way a card number can. For how other providers have handled patient notices, see the healthcare provider breach notice guide.

What should people who got a letter do?

The notice recommends watching account statements, credit reports and explanation of benefits (EOB) statements, and reporting anything suspicious. It also recommends an IRS identity protection PIN, which anyone who can verify their identity can now get online, to block a tax return filed in their name. Fraud alerts and credit freezes are free at the three bureaus. The organization's response line is 1-866-659-7097, Monday to Friday, 9:00 a.m. to 9:00 p.m. Eastern time, except holidays. The guide to credit monitoring offers explains what monitoring does and does not cover.

Is the 68,212 count confirmed?

Yes. The federal health breach portal lists Colorado Health Network Inc. as a health care provider with 68,212 people affected, the same total as Indiana's. The report is a hacking incident on a network server, submitted on June 19, 2026. Of the 412 reports submitted in 2026 that were open on the portal on November 13, it is the 62nd largest; the HHS 2026 ranking has the list.

How many Texans were affected by the Colorado Health Network breach?

Texas's attorney general lists a report from Colorado Health Network Inc., posted on June 25, 2026, with 257 Texans affected. It lists names, addresses, Social Security numbers, driver's license numbers, other government ID numbers, financial account or card numbers, medical information, health insurance information and dates of birth among the information involved. The Texas ranking has 2026's largest reports. The figure counts Texas residents only; the public list gives no national total.

What the record leaves open

• When the intrusion was found, and how long it lasted.
• How the intruder got in, and whether it was ransomware.
• Whether a monitoring offer came with the letters; the website notice does not describe one.