Centric Health Data Breach 2025: 6,855 Affected · Hacking/IT Incident · CA. Filed With HHS OCR. What To Do.

Centric Health, a multi-specialty healthcare provider headquartered in Bakersfield, California, filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on December 10, 2025, reporting 6,855 affected individuals. OCR classified the event as a Hacking/IT Incident involving an Electronic Medical Record and Network Server, with a business associate identified as involved in the underlying incident.

Centric Health has not, as of this update, posted a substitute notice on its public website, and the entity has not been listed in the California Attorney General’s published sample-notice index. Specific exposed data elements, the unauthorized-access window, attacker attribution, and any complimentary credit monitoring have therefore not been confirmed by the entity itself. The information below reflects the federal regulatory record plus secondary coverage; we will update each section as the entity’s own letter, a state AG sample notice, or court filings become available.

Timeline

• December 10, 2025 — Centric Health filed a Hacking/IT Incident breach report with HHS OCR covering 6,855 individuals.
• February 5, 2026 — Plaintiff firm Strauss Borrelli PLLC publicly announced a class-action investigation tied to the HHS filing.

The dates of initial unauthorized access and internal discovery have not been disclosed in any publicly available source.

What was exposed

The OCR portal classifies the breached information as residing on an Electronic Medical Record and a Network Server, which under HHS taxonomy typically encompasses protected health information.

Centric Health has not yet itemized the specific data elements involved. Until the entity’s notification letter is published, treat the categories below as plausible but unconfirmed for this incident: names, dates of birth, addresses, Social Security numbers, medical and treatment information, and health-insurance details. We will replace this paragraph with the entity’s confirmed list once a substitute notice or sample notification letter is filed.

What Centric Health is offering affected individuals

No public substitute notice has been posted by Centric Health, and no credit-monitoring or identity-protection offering has been confirmed. If you receive an individual notification letter, it should specify any complimentary services and the enrollment deadline.

Class-action activity

Strauss Borrelli PLLC has publicly announced an investigation into the incident and is soliciting affected individuals. No filed class-action complaint or consolidated docket has been identified in public court records as of this update.

What to do if you may be affected

Until Centric Health publishes its substitute notice or your individual notification letter arrives, the protective steps to take are generic but useful:

• Freeze your credit with the three nationwide consumer reporting agencies. It is free, takes about ten minutes per bureau, and is the single highest-leverage step against identity theft.
• Watch for a notification letter at the address on file with Centric Health. Notification letters typically follow the OCR filing by a few weeks to a few months. Read it carefully. It will list the specific data elements exposed and any complimentary credit-monitoring offered.
• Be cautious of unsolicited contact referencing this breach. Plaintiff-firm and “claim depot” sites are not the entity itself and cannot enroll you in credit monitoring.
• Bookmark this page. We update it as new information becomes publicly available.

Sources on this page

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach.
• Strauss Borrelli PLLC — Centric Health Data Breach Investigation — plaintiff-firm announcement referencing the HHS filing.
• ClaimDepot — Centric Health Data Breach Impacts 6,855 Patients — secondary aggregator summary of the HHS filing.
• Centric Health (entity website) — entity homepage; no public substitute notice posted as of this update.