CHCP Data Breach Exposes Sensitive Personal and Health Info

The College of Health Care Professions, also known as CHCP, disclosed a data breach that may have exposed sensitive personal information belonging to employees, students and the relatives or guardians of students.

The breach was reported to the Vermont Attorney General on March 26, 2026. The school posted a notice about the incident on its website on March 12, 2026, and began mailing notifications to affected individuals.

What happened in The College of Health Care Professions data breach

On or about Aug. 21, 2025, CHCP discovered suspicious activity related to certain computer systems within its network, according to the company's notification to consumers. The school took portions of its network offline and isolated the affected systems.

CHCP also brought in outside cybersecurity professionals to investigate the activity.

The investigation found that an unauthorized third party accessed a limited portion of CHCP's computer network between Aug. 16 and 20, 2025. During that time, certain files within the network may have been accessed or downloaded without authorization.

On Jan. 30, 2026, more than five months after the initial discovery, the school determined that personal information was potentially contained in the files that may have been downloaded by the unknown third party.

The types of information exposed varied by individual but could have included names, addresses, Social Security numbers, driver's license numbers or government-issued identification numbers, financial account information, medical information and health insurance information.

The College of Health Care Professions' response to the breach

Given the serious nature of the information exposed (including Social Security numbers, financial account details and medical records), CHCP is offering affected individuals complimentary credit monitoring through Experian IdentityWorks. The service includes credit monitoring on Experian files, daily credit reports for online members, identity restoration support and $1 million in identity theft insurance.

Affected individuals also have access to Experian IdentityWorks ExtendCare, which provides the same level of identity restoration support even after the membership period expires. Those who believe their information was used fraudulently can work with an Experian Identity Restoration agent to investigate and resolve incidents of fraud.

CHCP has set up a dedicated toll-free assistance line at 844-443-1772, available from 8:00 a.m. to 5:30 p.m. Central Time, Monday through Friday (excluding holidays). Affected individuals can also reach Experian's customer care team at 866-242-0627, available Monday through Friday from 8:00 a.m. to 8:00 p.m. Central Time.

Steps to take if your information was exposed

• Place a credit freeze with all three credit bureaus by contacting Equifax at 1-800-685-1111, Experian at 1-888-397-3742 and TransUnion at 1-800-916-8800 to help prevent new accounts from being opened using stolen information.
• Request free credit reports at AnnualCreditReport.com and review them for any unfamiliar accounts, inquiries or other suspicious activity.
• Monitor financial accounts closely by reviewing bank and credit card statements regularly and setting up transaction alerts to catch unauthorized charges quickly.
• Review medical and health insurance statements for any services, prescriptions or claims that were not received, since medical information and health insurance information may have been exposed in this breach.
• Be cautious of phishing attempts that reference The College of Health Care Professions, CHCP or this data breach by name, as scammers often use real breach notifications to trick people into sharing more personal details.
• Consider placing a fraud alert on credit files by contacting any one of the three major credit bureaus, which will then notify the other two.