Community Health Action of Staten Island Data Breach 2026 (GENESIS Ransomware): 501+ Patients Exposed. HIV/SUD/Harm-Reduction Records. What To Do

What happened

Community Health Action of Staten Island (CHASI) is a Staten Island nonprofit (EIN 13-3556132, founded 1988) providing harm reduction, HIV/AIDS services, syringe exchange, behavioral health, substance use services, pregnancy support, food pantry, and wellness programs to underserved NYC populations. Per RedPacket Security indexing, CHASI is identified as part of Sun River Health (an FQHC network) — affiliation is unconfirmed by the entity itself.

Between October 31, 2025 and January 5, 2026, an unauthorized actor accessed CHASI’s computer network. CHASI discovered the unusual activity on January 5, 2026. On February 13, 2026, the GENESIS ransomware group posted CHASI on its dark-web leak site, claiming exfiltration of approximately 200,000 records including:

• ~60,000 HIV-tested patient database records
• HIPAA-covered data
• Employee files, contracts, financials

CHASI filed with the Massachusetts AG on February 25, 2026 and with HHS OCR on March 9, 2026 (501 interim count). Individual notification letters began March 6, 2026.

The 501 OCR figure is interim and is likely to grow materially — GENESIS’s claim of 200,000 records, including 60,000 HIV-specific records, suggests the actual affected population is far larger than the OCR placeholder.

Why this breach is uniquely severe

CHASI’s patient population includes people who use drugs, people living with HIV, sex workers, people experiencing homelessness, and members of the LGBTQ+ community served by syringe exchange and PrEP programs. HIV status disclosure carries lifetime employment, housing, immigration, and family consequences that are categorically more severe than typical PHI breaches.

GENESIS’s specific claim of ~60,000 HIV testing records makes this — if borne out — one of the most consequential HIV privacy breaches in recent US history.

Three legal regimes apply, beyond HIPAA:

1. NY Public Health Law Article 27-F — special HIV confidentiality protections with private right of action
2. 42 CFR Part 2 — if CHASI is a federally-assisted SUD program (likely given its harm reduction and syringe exchange work), SUD treatment records carry stricter consent and re-disclosure protections than HIPAA. OCR began enforcing Part 2 under a unified rule effective February 16, 2026 — civil enforcement is now active
3. NY SHIELD Act — requires breach notification to NY AG, NY DOS, and State Police

What was stolen — conflicting disclosures

Per CHASI’s own notice (the most conservative source):

• Names, addresses, medical treatment information only

Per Massachusetts AG filing (broader scope):

• • Social Security number
• • Driver’s license / non-driver ID
• • Bank account / routing number
• • Health insurance information

Per GENESIS leak-site claim (broadest scope):

• • ~60,000 HIV testing patient database records
• • Employee / HR data, contracts, financials

The discrepancy between CHASI’s notice and the Massachusetts AG filing is itself a flag — entity-issued notices in healthcare breaches often understate exposure compared to required state AG disclosures.

What CHASI is offering

• 2 years complimentary Experian IdentityWorks (credit monitoring, identity restoration)
• Dedicated toll-free call center: (844) 443-1607 (Monday to Friday, 9 a.m. to 6:30 p.m. Eastern)
• Statement-review recommendation
• “Enhanced monitoring and alerting software” deployed

What to do

1. Enroll in the 2-year Experian IdentityWorks through the activation code in your letter — this is one of the longer monitoring offerings in the 2026 breach landscape.
2. Place free credit freezes at Equifax, Experian, TransUnion. SSN is in scope per the MA AG filing.
3. File IRS Form 14039.
4. If your HIV status was in scope, you have additional protections under NY Public Health Law Article 27-F — you can sue for unauthorized re-disclosure with stronger remedies than HIPAA. Document any future surfacing of your HIV status.
5. If your SUD treatment records were in scope, you have additional protections under 42 CFR Part 2 — civil enforcement is now active as of February 2026.
6. If you are a current or former CHASI client, consider whether your immigration status, employment, or housing could be affected by HIV/SUD record exposure and prepare proactive responses.
7. Stop the ongoing flow of your CHASI service data. HealthConsent files HIPAA and 42 CFR Part 2 restriction requests so the harm reduction, HIV, and SUD treatment data exposed in this breach is not continuously re-shared.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches