cCARE Data Breach Exposes Sensitive Patient Info of Thousands

California Cancer Associates for Research and Excellence experienced a data breach affecting multiple locations and tens of thousands of patients. The cybersecurity incident compromised both personally identifiable information (PII) and protected health information (PHI).

The breach occurred over a three-day period, from Dec. 13 to Dec. 16, 2024, due to an email phishing attack that resulted in unauthorized access of Integrated Oncology Network (ION) employee email and SharePoint accounts. Compromised information includes Social Security numbers, names, addresses, dates of birth, financial account information, diagnosis, lab results, medication, treatment information, health insurance and claims information, provider names, and dates of treatment.

Integrated Oncology Network (ION) owns and provides administrative services to several oncology practices, and disclosed the data breach to California Cancer Associates for Research and Excellence on June 13, 2025. The total number of affected patients has not been released.

California Cancer Associates for Research and Excellence reported the data breach to the U.S Department of Health and Human Services on June 27, 2025. The total number of affected individuals is up to 25,558, includig 7,670 patients at the cCare Fresno location, 17,250 patients at the High Desert location, and 638 at San Diego.

cCARE's response

In addition to the federal disclosure, cCare reported the data breach to the California Attorney General's office on June 27, 2025 and published a Notice of Email Phishing Incident on its own website. ION began notifying affected patients by mail on June 27, 2025.

If you receive a data breach notice from cCare or Integrated Oncology Network about, you may want to:

• Carefully review any notice or communication you receive and sign up for free Epiq Privacy Solutions ID credit monitoring offered.
• Monitor financial accounts and credit reports for signs of identity theft.
• Consider placing fraud alerts or credit freezes with major credit bureaus.
• Be cautious of unsolicited emails or phone calls requesting personal information.

More information about their services can be found on the cCARE website.