Escambia Community Clinics (Community Health Northwest Florida) Data Breach: 143,969 Affected · RansomHub Attack · Pensacola FQHC

What happened

Escambia Community Clinics, Inc., the nonprofit operator of Community Health Northwest Florida (CHNF) in Pensacola, reported a hacking incident to the HHS Office for Civil Rights on February 3, 2025, affecting 143,969 individuals. Founded in 1992 as a small outpatient primary-care clinic, CHNF has grown into a network of 19 locations across the Pensacola area including clinics, school-based sites, pharmacies, dental offices, and optometry practices. The organization employs 377 people and serves approximately 58,820 patients per year, functioning as the primary-care safety net for medically underserved residents of Escambia and Santa Rosa counties.

On December 24, 2024, CHNF detected suspicious activity within its network environment and immediately took its systems offline as a precaution. The attack disrupted phones, email, internet, and servers across all locations, temporarily preventing patients from making appointments or filling prescriptions. CEO Chandra Smiley publicly acknowledged the attack on December 26, 2024, noting that dental, pharmacy, x-ray, and mammography services were temporarily affected while pediatric and primary-care appointments continued on a limited basis. CHNF engaged third-party cybersecurity specialists to investigate and restore operations; by January 12, 2025, the organization announced that all systems were restored. The RansomHub ransomware group posted CHNF on its dark-web leak site on January 13, 2025, claiming 68 GB of stolen data and issuing a one-week ransom payment deadline. CHNF has not publicly confirmed whether a ransom was paid.

RansomHub operates on a ransomware-as-a-service model in which affiliates pay to use the group’s malware and infrastructure to launch attacks. The group first appeared in February 2024 and has since claimed hundreds of attacks across healthcare and other sectors.

The forensic review proved unusually time-consuming. CHNF engaged an outside data mining firm to conduct a file-by-file review of the affected systems. That process was not completed until January 19, 2026, more than 13 months after discovery. CHNF filed an early incident notice with HHS OCR on February 3, 2025, as required by HIPAA’s 60-day reporting deadline, and also posted an early cybersecurity incident notice on its website in March 2025. Individual notification letters were not mailed until January 26, 2026. HIPAA Journal covered this breach as part of its reporting on healthcare organizations that delayed notifying individuals of 2024 incidents by more than a year.

What was exposed

According to the substitute notice and the notification letter distributed to affected individuals, the following data elements were potentially exposed, varying by person:

• Full name
• Date of birth
• Social Security number
• Driver’s license or state identification card number
• Financial account number
• Credit or debit card number
• Patient identification and medical record number
• Medical information
• Health insurance information

The combination of Social Security number, driver’s license number, financial account data, and detailed clinical records places this breach in the most severe category for downstream identity-theft and medical-identity-fraud risk.

What CHNF is offering

CHNF’s January 2026 notification letters offer 12 months of complimentary single-bureau credit monitoring, a credit report, and a credit score through Cyberscout, a TransUnion company, along with proactive fraud assistance. Enrollment requires the unique code provided in the notification letter and must be completed within 90 days of the letter date (letters dated January 26, 2026, so the enrollment window closed approximately April 26, 2026). Enrollment is done online and requires an internet connection and email address; it is not available to minors under 18.

If you did not receive a letter but believe you may be affected, CHNF established a dedicated assistance line at 850-384-4701 (Monday through Friday, 9 a.m. to 6 p.m. Eastern, excluding national holidays). A second assistance number, 833-580-0425 (Monday through Friday, 8 a.m. to 8 p.m. Eastern), has been cited in secondary reports. If your enrollment window has closed, call to ask whether monitoring can still be activated.

Sensitive-population considerations (FQHC)

Community Health Northwest Florida is a federally qualified health center serving the Florida Panhandle. FQHC patient panels typically include populations for whom this kind of disclosure carries above-average harm:

• Medicaid, dual-eligible, and uninsured patients who depend on CHNF as their only realistic primary-care option and cannot easily change providers.
• Patients with behavioral health, HIV, substance-use, or reproductive-health encounters. The breached “medical information” element could include records from these encounters. Under 42 CFR Part 2 (civil enforcement provisions live as of February 16, 2026), substance-use-disorder records carry stronger federal protections than standard HIPAA records and stronger private remedies if improperly re-disclosed.
• Limited-English-proficiency and undocumented patients who may not receive or be able to act on a mailed English-language notification letter.
• Pediatric patients whose Social Security numbers, if exposed, are high-value for synthetic-identity fraud. SSN fraud built on a child’s number can go undetected until the child reaches adulthood and applies for credit or employment.

If you received care at CHNF, including at its Pensacola, Brent Lane, Lillian, Century, or school-based and mobile clinic sites, assume your record may be in scope and take protective steps regardless of whether a letter has reached you.

Class actions

Multiple plaintiff firms announced class-action investigations within days of the January 26, 2026 substitute notice:

• Strauss Borrelli PLLC — announced January 27, 2026
• Shamis & Gentile P.A. — announced January 27, 2026

The fact pattern driving these investigations: a 13-month gap between incident discovery and individual notification, RansomHub’s public exfiltration claim, and the breadth of data elements (SSN plus financial account plus full medical record). No docket number for a filed complaint has been publicly confirmed as of this writing.

What to do

1. Freeze your credit at all three bureaus: Equifax (equifax.com), Experian (experian.com), and TransUnion (transunion.com). With SSN, date of birth, and driver’s license number in the leaked set, a credit freeze is the highest-leverage protective step. It is free and reversible.
2. Enroll in CHNF’s credit monitoring if your 90-day window is still open. If the deadline has passed, call 850-384-4701 to ask whether enrollment can still be activated. Enrollment does not waive any legal claims.
3. File IRS Form 14039 (Identity Theft Affidavit) if you are concerned about tax-return fraud. With Social Security numbers confirmed in scope, tax-identity theft is a real risk.
4. Pull your medical records and explanation-of-benefits statements from CHNF and from any insurer that covered your CHNF care. Flag any services, prescriptions, or referrals you do not recognize. Medical-identity theft is harder to detect than financial fraud and harder to unwind.
5. Watch financial accounts and card statements closely for the next 12 to 24 months. Threat actors often hold compromised financial data for months before monetizing it.
6. Be alert for targeted phishing referencing CHNF, your provider, or your medications. Attackers who exfiltrate clinical records frequently use those details to craft convincing follow-on messages.
7. If you are a parent of a CHNF pediatric patient: freeze your child’s credit at all three bureaus now. Synthetic-identity fraud built on a child’s SSN can go undetected for years.
8. Stop the ongoing flow of your health data. HealthConsent files HIPAA restriction requests so the medical and insurance information exposed in this breach is not continuously re-shared with insurers, data brokers, and third-party health networks.

Continue reading

• Your HIPAA rights, including the right to restrict how your records are shared
• All tracked healthcare data breaches