Erie Family Health Centers data breach: seven weeks of network access and a long list of data

What happened at Erie Family Health Centers?

Erie says it learned of possibly unauthorized access to some systems on its network on January 27, 2026, and investigated with outside specialists. It says it reported the incident to law enforcement and strengthened its network security. The notice does not say how the access began or whether files were taken.

Date	What the notice and the regulators' records say
December 10, 2025	Unauthorized access begins; Indiana gives this as the breach date
January 27, 2026	Erie learns of the access, and the access ends
March 27, 2026	Report submitted to HHS: hacking or IT incident, network server, 570,000 people
July 10, 2026	Indiana's report gives this as the date notice was sent, with a total of 483,245

The access lasted 48 days. Erie's report reached HHS 59 days after it found the intrusion; the federal rule sets 60 calendar days from discovery as the outer limit for notifying people. The notice-sent date on Indiana's record is 164 days after discovery.

What information was involved in the Erie breach?

The notice says the information varied by person and may have included any of the items below.

Group	Items the notice lists
Contact	Name, address, phone number, email address
Government ID	Social Security number, driver's license or state ID number, taxpayer ID number, passport number
Money	Financial account information, payment card information, treatment cost information
Logins and identity	Online account credentials, digital signature, biometric data, date of birth
Care	Medical treatment or diagnosis, prescriptions, date of service, provider name
Record numbers	Patient ID, encounter ID, patient account number, medical record number
Insurance	Medicare or Medicaid number, health insurance information

Because online account credentials are on the list, changing the password on any account that shares one with an Erie account is a sensible first step.

How many people were affected?

Regulator	What it counts	Number
HHS Office for Civil Rights	Individuals affected	570,000
Indiana attorney general	Total affected	483,245
Indiana attorney general	Indiana residents	78

The HHS figure is a round number; Indiana's is exact and carries a July notice date. Neither regulator explains the difference. Erie's report is 18th among the 2026 cases in the HHS ranking, and 22nd by total in Indiana's 2026 report.

What is Erie offering people who got a letter?

The notice says letters include access to free credit monitoring and identity protection services; the provider and the length are not on the public notice. Erie also runs a toll-free call center for questions and enrollment.

Item	Detail from the notice
Call center	833-297-4842
Hours	7:00 a.m. to 7:00 p.m. Central Time, Monday to Friday, excluding major U.S. holidays
Postal address	Erie Family Health Centers, Attn: Privacy, 1701 W. Superior St., Chicago, IL 60622
Credit freeze	Free to place or lift, at each of the three bureaus

Erie says letters go only to people for whom it has an address, so a patient with an old address may not get one. Calling the center is the way to ask. The notice is posted in English and Spanish.

What the documents leave open

• How the intruder got in, and whether data was copied out.
• The monitoring provider and the length of the offer.
• Why HHS and Indiana carry different totals and dates.

For how other clinics' letters compare, see the guide to healthcare provider breach notices and the HIPAA breach notification rule.