Colorado Health Network Data Breach Exposes PII and PHI Information of Patients

Colorado Health Network Inc., a Denver-based nonprofit that provides medical care and support services to people living with HIV/AIDS and other health conditions across Colorado, has disclosed a data breach involving sensitive personal and health information. The total number of individuals affected by the breach has not been publicly reported.

The consumer notification letter does not include specific dates for when the unauthorized access occurred or when the organization first discovered the breach; however, on Aug. 28, 2025, a threat actor using the name Cephalus posted on the Tor network, alleging it had obtained more than 900 GB of data from Colorado Health Network.

A wide range of personally identifiable information and protected health information was exposed including names, addresses, dates of birth, Social Security numbers, Social Security cards, driver's license or state identification card numbers, passport numbers, government-issued identification cards, W2 forms, proof of current address, financial account information and debit or credit card information, medical information such as diagnoses, medical and physical conditions, diagnosis codes and prescription information.

The breach was disclosed to the Massachusetts Office of Consumer Affairs and Business Regulation on June 22, 2026. The organization also posted a notice of the data security incident on its website.

Colorado Health Network's response to the breach

Colorado Health Network is offering affected individuals a complimentary 24-month membership to identity monitoring services through Epiq's Privacy Solutions ID program. To enroll, affected individuals can visit privacysolutionsid.com and enter the activation code included in their notification letter. Enrollment must be completed before the deadline printed in the letter.

Colorado Health Network set up a dedicated phone line for questions about the incident at 1-866-659-7097, available Monday through Friday from 9 a.m. to 9 p.m. Eastern time, excluding holidays. For help with the identity monitoring enrollment process, individuals can call Epiq directly at 866-675-2006, Monday through Friday from 9 a.m. to 5:30 p.m. Eastern time.