How do I know if I am affected by the Central Ozarks Medical Center data breach?

Central Ozarks Medical Center is mailing notification letters directly to affected individuals. If you have received care or services from Central Ozarks Medical Center (also operating as COMC) in the period leading up to January 2026 and you have not received a letter, contact the entity directly. 11,818 individuals were confirmed affected in the HHS OCR filing.

What data was exposed in the Central Ozarks Medical Center breach?

According to the notification letter and supporting filings, the compromised data included: Full name, Date of birth, Home address, Social Security number, Financial account information, Government IDs, Medical treatment information and diagnoses, Health insurance information.

Was Central Ozarks Medical Center attacked by a ransomware group?

No threat actor has publicly claimed responsibility for the Central Ozarks Medical Center breach. The incident is categorized in the HHS OCR portal as a hacking.

What is HealthConsent and how does it help with the Central Ozarks Medical Center breach?

HealthConsent is an independent health-data privacy service. We help affected individuals stop the ongoing flow of their health information by filing HIPAA restriction requests, FTC Health Breach Notification Rule deletion requests, and state-law deletion requests across providers, insurers, Health Information Exchanges, prescription networks, and data brokers. Credit monitoring offered by Central Ozarks Medical Center addresses identity-theft risk; HealthConsent addresses the longer-tail problem of your exposed health data continuing to be sold and shared by other entities downstream.

Active breach tracker Mid-Missouri Disclosed January 9, 2026

Central Ozarks Medical Center Data Breach 2026: 11,818 Missouri FQHC Patients Exposed. SSN + Financial in Scope. What To Do

Q: Should I file a lawsuit over the Central Ozarks Medical Center data breach?

3 plaintiffs' firms have publicly announced investigations or filed complaints related to the Central Ozarks Medical Center breach: Federman & Sherwood (publicly investigating), Strauss Borrelli (publicly investigating), Shamis & Gentile (publicly investigating). We are not a law firm and cannot give legal advice; consult your own attorney to evaluate your options.

Central Ozarks Medical Center, a Missouri Federally Qualified Health Center serving the Lake of the Ozarks region across five counties, disclosed in January 2026 a November 2025 network intrusion exposing names, Social Security numbers, financial account information, and medical records for 11,818 patients. 12 months IDX monitoring offered. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated May 15, 2026 Sources & methodology

Timeline

Nov 10, 2025

Intrusion discovered (approximate)

Nov 10, 2025

Attacker gained access

Jan 9, 2026

Filed with HHS OCR; notification letters mailed

Nov 10, 2025

Intrusion discovered (approximate)

Nov 10, 2025

Attacker gained access

Jan 9, 2026

Filed with HHS OCR; notification letters mailed

Data exposed

High-risk identity

Enables financial + identity theft

Date of birth Social Security number Government IDs

Health records

Don't expire and can't be reissued

Medical treatment information and diagnoses

Contact & insurance

Phishing + targeted scams

Full name Home address Financial account information Health insurance information

Class actions filed by

These firms have publicly announced investigations. You may be eligible to join. We are not a law firm and cannot give legal advice.

Federman & Sherwood (publicly investigating) Strauss Borrelli (publicly investigating) Shamis & Gentile (publicly investigating)

If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

Accept credit monitoring

It’s the floor of the response. Take it.

Freeze your credit

Free at Equifax, Experian, TransUnion.

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

Review your EOBs

Insurance statements catch medical identity theft early.

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

Central Ozarks Medical Center (COMC) is a Federally Qualified Health Center founded in 1979 and headquartered in mid-Missouri, serving the Lake of the Ozarks region across five Missouri counties from approximately six clinics. Services include family practice, pediatrics, OB/GYN, dental, behavioral health, and substance-use disorder treatment.

On approximately November 10, 2025, an unauthorized third party accessed COMC’s network. The forensic review preceded the public filing on January 9, 2026, when COMC submitted to HHS OCR and mailed individual notification letters. The filing confirmed 11,818 affected individuals (including 11 Indiana residents and 1 Massachusetts resident per state filings).

No ransomware group has publicly claimed responsibility. HIPAA Journal noted that COMC’s substitute notice omits the intrusion start date and dwell time — a transparency deficiency flagged by industry reporting.

Because COMC offers substance-use disorder treatment as part of its FQHC service mix, a portion of the affected records may be protected under 42 CFR Part 2 in addition to HIPAA.

What was stolen

Full name, date of birth, home address
Social Security number
Financial account information
Government IDs
Medical treatment information and diagnoses
Health insurance information

What COMC is offering

At least 12 months of complimentary credit monitoring + identity-theft protection via IDX
Dedicated call center: 833-816-6531 (Monday to Friday, 9 a.m. to 9 p.m. Eastern)
Cybersecurity enhancements implemented internally

What to do

Enroll in IDX through the activation code in your letter.
Place free credit freezes at all three bureaus.
Cancel and reissue any payment cards that may be tied to financial account information.
File IRS Form 14039.
Exercise 42 CFR Part 2 rights if you received SUD treatment from COMC.
Stop the ongoing flow of your community-health data. HealthConsent files HIPAA restriction requests and Part 2 redisclosure restrictions.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.