Wilmington Community Clinic Data Breach Exposes PII & PHI

On Aug. 13, 2024, Wilmington Community Clinic, a nonprofit health center in Wilmington, Calif., discovered that its computer systems had been compromised by an unauthorized actor. The compromised data included a mix of personally identifiable information (PII) and protected health information (PHI) of an undisclosed number of individuals.

After discovering the breach, Wilmington Community Clinic engaged a third-party vendor to review the compromised data. This process, involving both automated and manual review, was complex and took several months due to the volume and types of data involved.

By Oct. 13, 2025, the clinic had hired a third-party notice vendor to assist with notifications, call center support and identity theft protection services. The final list of individuals to notify was completed by Nov. 18, 2025.

Possible information exposed includes name, date of birth, driver’s license number or state identification number, health insurance identification number and medical information. The exposure of both PII and PHI puts individuals at risk of identity theft and medical fraud, underscoring the seriousness of this breach.

The company has posted a notice of data breach on it's website and disclosed the event to the California Attorney General’s office on Dec. 11, 2025.

Wilmington Community Clinic's response

Wilmington Community Clinic has taken several steps in response to the breach. Immediately after learning of the incident, the clinic disconnected all access to its network and worked with cybersecurity experts to secure its systems and investigate the breach. Operations were restored in a safe and secure manner, and security measures have since been enhanced to mitigate the risk of future incidents.

To support those affected, the clinic is offering 12 months of complimentary credit monitoring and identity theft restoration services through HaystackID.

If you believe your personal information may have been compromised in this breach:

• Carefully review any notice or communication you receive from Wilmington Community Clinic or a company that does business with the clinic.
• Monitor financial accounts and credit reports for signs of identity theft.
• Consider placing fraud alerts or credit freezes with the major credit bureaus.
• Be cautious of unsolicited emails or phone calls requesting personal information.

For impacted individuals, Wilmington Community Clinic has set up a dedicated line at 888-844-1319, Monday through Friday, during the hours of 8:00 a.m. to 11:00 p.m. ET.