College Hometown Pharmacy Data Breach 2025: 9,742 Affected · Albany College of Pharmacy Network Intrusion · NY

College Hometown Pharmacy, a not-for-profit community pharmacy in Schenectady, New York operated by Albany College of Pharmacy and Health Sciences (ACPHS), reported to the U.S. Department of Health and Human Services Office for Civil Rights on August 25, 2025 that the personal and protected health information of 9,742 individuals was exposed in a network intrusion. The HHS OCR portal classifies the incident as a Hacking/IT Incident affecting a Network Server.

According to ACPHS’s substitute notice and reporting by HIPAA Journal, an unauthorized third party had access to the pharmacy’s network from August 31, 2024 through September 14, 2024, when unusual activity was detected and the access was contained. The pharmacy completed its review of the affected files in spring 2025 and began mailing individual notification letters on June 16, 2025. The College Hometown filing is one of two ACPHS pharmacy filings tied to the same intrusion. The other, College Parkside Pharmacy, affected an additional 5,736 individuals. ACPHS’s umbrella notification covered roughly 28,600 people across the institution.

Timeline

• August 31, 2024 — Unauthorized access to the network begins.
• September 14, 2024 — Unusual activity is identified, the intrusion is contained, and external cybersecurity specialists are engaged.
• June 16, 2025 — Individual notification letters begin going out to affected pharmacy customers.
• August 25, 2025 — Breach is formally reported to HHS Office for Civil Rights, with 9,742 individuals listed for the College Hometown Pharmacy entity.
• Early September 2025 — Plaintiffs’ firms publicly announce class-action investigations.

What was exposed

The categories of information varied by individual. According to ACPHS’s notification and contemporaneous reporting, the data potentially involved a combination of:

• Name, address, phone number, and date of birth
• Social Security number, driver’s license number, passport number, and other government-issued identifiers
• Payment card data and financial account and routing numbers
• Health insurance information, medical record number, diagnosis and treatment information, prescription history, and provider name
• In some cases, usernames and passwords, digital signatures, and student information

Not every affected person had every category exposed. The specific elements applicable to an individual are listed in their notification letter.

What is being offered

ACPHS’s substitute notice and HIPAA Journal’s reporting state that complimentary credit-monitoring services are being made available to affected individuals. The notification letters carry the enrollment code and the deadline by which credit monitoring must be activated. No attacker has been publicly identified, and no ransom demand or data-leak-site posting has been reported in the public record reviewed for this page.

Class-action posture

At least three plaintiffs’ firms have publicly announced investigations into the breach: Strauss Borrelli PLLC, Barnow and Associates, P.C., and the Srourian Law Firm. As of this page’s last update, the public record does not yet show a filed class-action complaint specific to College Hometown Pharmacy. The HHS OCR investigation remains open.

What to do if you may be affected

• Read your notification letter carefully. It lists the specific data elements exposed for you and the enrollment code for the complimentary credit-monitoring offer. Enroll before the deadline noted in the letter.
• Freeze your credit with the three nationwide consumer reporting agencies (Equifax, Experian, and TransUnion). Freezes are free, take about ten minutes per bureau, and are the single highest-leverage step against new-account identity theft.
• Watch for prescription and health-insurance fraud. Review explanation-of-benefits statements from your health plan for prescriptions or services you did not receive. Report anomalies to your insurer.
• Be cautious of unsolicited contact that references this breach, your prescriptions, or ACPHS. Phishing campaigns commonly follow public breach notifications.
• Preserve your notification letter. If a class-action complaint is filed and you wish to participate, the letter is the cleanest proof that you are within the notified class.

Sources on this page

• HHS Office for Civil Rights Breach Portal — federal regulatory record of the College Hometown Pharmacy filing.
• HIPAA Journal — Cybercriminals Hit Washington Laboratory and New York Pharmacies — trade-press reporting on the College Hometown and College Parkside filings, with confirmed exposed-data categories and counts.
• HIPAA Journal — Albany College of Pharmacy and Health Sciences Cyberattack Affects 28,600 Individuals — ACPHS umbrella notification, access window, detection date, June 16, 2025 notification date, and credit-monitoring offer.
• Strauss Borrelli PLLC — College Hometown Pharmacy Data Breach Investigation — plaintiffs’-firm investigation announcement.
• Barnow and Associates, P.C. — College Hometown Pharmacy Data Breach Investigation — additional plaintiffs’-firm investigation, confirms ACPHS/Schenectady operating relationship.
• Srourian Law Firm — Class Action Litigation Investigation — third plaintiffs’-firm investigation announcement.