Almeida Law Group is investigating a data breach at Boston Healthcare for the Homeless Program. The breach occurred on October 31st, 2025 – November 11th, 2025 and was discovered on June 8th, 2026. If you were affected, contact Almeida Law Group.
About Boston Healthcare for the Homeless Program
Boston Health Care for the Homeless Program (BHCHP) is a nonprofit, Federally Qualified Health Center founded in 1985 and headquartered at 780 Albany Street in Boston, Massachusetts. The organization provides comprehensive medical, behavioral health, dental, and social services to individuals and families experiencing homelessness across Greater Boston, operating at more than 80 sites — including shelter-based clinics, hospital-based clinics, street outreach teams, and a medical respite facility — and serving nearly 10,000 people per year with a staff of over 600. Because BHCHP delivers direct patient care and manages enrollment in health coverage programs, it maintains highly sensitive personal, medical, and insurance records for a large and vulnerable population.
What Happened?
Boston Healthcare for the Homeless Program was listed in a Texas Attorney General data security breach report (record ID BR-0005240). According to that filing, unauthorized activity occurred between October 31st, 2025 and November 11th, 2025, affecting a total of 201,260 individuals. The breach was not discovered until June 8th, 2026 — approximately seven months after it began — and consumers were notified by U.S. Mail. The compromised information included names, Social Security numbers, medical information, and health insurance information. The Texas Attorney General published the report on August 10th, 2026; BHCHP also reported the breach to the Vermont Attorney General on approximately August 8th, 2026.
The nature of the attack — whether ransomware, unauthorized network access, or another method — has not been publicly detailed by BHCHP as of available research, and no specific threat actor has been attributed to this incident in public sources. BHCHP has experienced prior security incidents, including a 2018 physical trespass at its St. Francis House clinic that potentially exposed patient records, and a separate February 2026 notice about a vendor cybersecurity incident involving TriZetto Provider Solutions. That TriZetto incident is a distinct vendor-related matter from the October–November 2025 breach reported to the Texas Attorney General. As of available research, no class action lawsuit has been confirmed in connection with the current breach, though Class Action U has listed this incident among active breach investigations, suggesting potential legal activity may be forming.
Key Facts at a Glance
- Company or Organization: Boston Healthcare for the Homeless Program
- Industry: Healthcare – Federally Qualified Health Center / Nonprofit Medical Provider
- Location: Boston, Massachusetts 02118
- Incident type: Unauthorized access (nature of attack not publicly specified)
- Date of breach: October 31st, 2025 – November 11th, 2025
- Date breach discovered: June 8th, 2026
- Date of consumer notification: August 10th, 2026 (published at Texas AG website)
- Total persons affected: 201,260
- Prior breach: Yes — 2018 physical trespass at St. Francis House clinic; separate February 2026 TriZetto vendor incident
- Litigation status: No confirmed class action; listed among active breach investigations by Class Action U
- Source: Texas Attorney General data security breach report, oag.my.site.com; Class Action U breach listing, classactionu.org
What Should You Do?
If you received a notification letter from Boston Healthcare for the Homeless Program, review it carefully for any identity theft protection enrollment offer and sign up before the stated deadline. Because Social Security numbers, medical information, and health insurance information were involved, you should place a fraud alert or credit freeze with the three major credit bureaus (Equifax, Experian, and TransUnion), and monitor your credit reports for unfamiliar accounts or inquiries — free annual reports are available at AnnualCreditReport.com. Watch your financial accounts closely for unauthorized transactions and report any suspicious activity to your bank immediately. Because health and insurance information was exposed, review your Explanation of Benefits statements and any medical records for services or claims you do not recognize, and report suspected medical identity theft to your insurer. For further guidance on responding to identity theft, visit IdentityTheft.gov.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
