Share Ourselves Healthcare Data Breach Report

Incident Overview

Share Ourselves, a California-based healthcare organization, experienced a significant data breach involving unauthorized access to its network server infrastructure. The breach was reported to the California Attorney General on December 26, 2025, affecting 2,864 individuals. This incident represents a hacking or IT-related compromise of the organization's computer systems, resulting in potential exposure of protected health information (PHI) maintained on networked servers. The breach occurred at a critical infrastructure point—the network server layer—which typically houses consolidated patient records, clinical documentation, and administrative data across multiple departments or service lines.

Discovery and Response Timeline

Share Ourselves identified the unauthorized access to its network server through security monitoring systems or incident detection protocols, though the specific discovery date and detection method have not been publicly detailed. Upon discovery, the organization initiated a formal investigation to determine the scope of the breach, identify affected individuals, and assess what categories of personal health information may have been compromised. The organization notified affected individuals in accordance with HIPAA Breach Notification Rule requirements, which mandate notification without unreasonable delay and no later than 60 calendar days after discovery of a breach affecting unsecured PHI. The December 26, 2025 submission date to the California Attorney General indicates the organization met its legal obligation to report breaches affecting more than 500 California residents to state authorities.

Technical Breach Details

Breach Vector and Attack Method

Network server breaches typically result from one or more of the following attack vectors: exploitation of unpatched software vulnerabilities, credential compromise (stolen or weak passwords), phishing attacks targeting employee access credentials, misconfigured firewall or access control settings, or advanced persistent threat (APT) campaigns. The fact that this breach occurred at the network server level—rather than at individual workstations or through physical theft—suggests the attacker gained elevated access to centralized systems housing multiple patient records simultaneously. This type of breach is particularly concerning because it can expose large volumes of data in a single compromise event. Network servers typically contain consolidated databases, electronic health record (EHR) systems, billing information, and administrative records that serve the entire organization.

The involvement of a business associate in this breach indicates that Share Ourselves may have contracted with a third-party vendor for services such as IT support, cloud hosting, data backup, billing services, or other healthcare operations. Under HIPAA regulations, covered entities remain liable for breaches involving business associates' systems, and business associates must maintain equivalent security safeguards. This adds complexity to breach investigations, as the compromised data may have been stored or processed across multiple organizations' systems.

Organizational Context

Share Ourselves operates as a healthcare provider organization in California. Based on the breach notification filing, the organization maintains patient records and health information systems that process protected health information subject to HIPAA regulations. The organization's service area encompasses California, with the breach affecting residents of that state. The involvement of a business associate suggests Share Ourselves utilizes external vendors for critical healthcare operations, which is common among mid-sized healthcare organizations that may lack in-house expertise for specialized functions like IT infrastructure management, cloud services, or billing operations.

Impact on Affected Individuals

Number of People Affected

The breach impacts 2,864 individuals whose personal health information may have been accessed or acquired without authorization. While this number falls below the 10,000-individual threshold for some regulatory classifications, the sensitivity of healthcare data and the network-level nature of the compromise elevate the significance of this incident. Each affected individual must be notified of the breach and informed of the specific types of information compromised, the organization's investigation findings, and recommended protective measures.

Personal Information Involved

Based on the network server location of the breach, the following categories of protected health information may have been exposed:

• Patient Names and Contact Information: Full names, addresses, telephone numbers, and email addresses
• Medical Record Numbers and Patient Identifiers: Internal identification numbers used to organize and retrieve patient records
• Social Security Numbers: Likely exposed if maintained in centralized patient databases for billing and identification purposes
• Date of Birth and Demographic Information: Age, gender, and other identifying characteristics
• Insurance Information: Health insurance policy numbers, group numbers, and subscriber information
• Clinical Information: Medical diagnoses, treatment histories, medication lists, and clinical notes
• Financial Information: Billing records, payment history, and account balances
• Emergency Contact Information: Names and phone numbers of designated emergency contacts

The specific data elements exposed depend on what information was stored on the compromised network server and what access the attacker obtained during the unauthorized access period.

Regulatory and Compliance Context

Under the HIPAA Breach Notification Rule (45 CFR §§ 164.400-414), covered entities must notify affected individuals of breaches of unsecured PHI. The rule defines a breach as "the unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of such information." Share Ourselves' notification to affected individuals and reporting to the California Attorney General demonstrates compliance with these federal requirements.

California law (California Civil Code § 1798.82) also requires notification of breaches of personal information, including health information, to California residents. Organizations must notify affected individuals without unreasonable delay. The December 26, 2025 submission to the California Attorney General satisfies the state-level reporting requirement for breaches affecting more than 500 California residents.

Network server breaches represent a significant category of healthcare data breaches. According to healthcare security research, hacking and IT incidents account for a substantial portion of reported healthcare breaches, often affecting larger numbers of individuals than theft or loss incidents due to the centralized nature of network systems. Organizations are expected to maintain appropriate technical safeguards including firewalls, intrusion detection systems, encryption, access controls, and regular security assessments to protect network infrastructure from unauthorized access.

Recommended Patient Actions

Individuals affected by this breach should take the following protective measures:

1. Monitor Credit Reports and Financial Accounts: Obtain free credit reports from all three major credit bureaus (Equifax, Experian, TransUnion) through AnnualCreditReport.com and review for unauthorized accounts or inquiries. Monitor bank and credit card statements for fraudulent transactions. Consider placing a fraud alert or credit freeze with credit bureaus if Social Security numbers were exposed.

2. Enroll in Credit Monitoring Services: Share Ourselves should offer complimentary credit monitoring and identity theft protection services for a period of time (typically 12-24 months). Affected individuals should enroll in these services if offered and monitor alerts for suspicious activity.

3. Review Medical Records and Explanation of Benefits: Request copies of medical records from Share Ourselves and review for unauthorized access or fraudulent medical services. Review Explanation of Benefits (EOB) statements from health insurance for claims related to services not received.

4. Contact Share Ourselves for Specific Information: Reach out to Share Ourselves' breach notification team to confirm exactly what information was compromised in the breach, obtain details about the investigation findings, and inquire about available remediation services. The organization should provide a dedicated phone line and website for breach-related inquiries.