Boston Health Care for the Homeless Program Data Breach Notice (Oregon Attorney General)

The personal information of people served by Boston Health Care for the Homeless Program was exposed in an incident that occurred on October 31, 2025. The organisation filed its notification with the Oregon Department of Justice on September 03, 2026 — an interval of 307 days, or roughly 10.1 months.

The filing does not disclose how many individuals were affected

Boston Health Care for the Homeless Program has not stated the number of people whose records were included. The record lists only one broad category: personal information. No passwords, no financial account numbers, and no government identifiers such as Social Security numbers appear in the filing.

What this exposure actually means for those affected

Because the exposed data includes personal information tied to healthcare services, the records almost certainly contain details that identity thieves value over long periods. Medical-related personal data combined with contact or address history can be used to file fraudulent insurance claims, apply for credit in someone else’s name, or build a profile for more targeted fraud. Unlike a credit card, this information cannot be cancelled or reissued.

The absence of passwords in the exposed categories is genuinely good news. There is no need to change any password for this provider because none was exposed. The risk lies entirely in the non-credential personal details that stay valuable to criminals for years.

The letter is the only reliable way to know if you were included

The organisation is required to notify affected individuals directly, usually by mail sent to the address it has on file. If you have not received such a letter, it is likely that your records were not part of this incident. However, anyone who has moved since October 31, 2025 should contact Boston Health Care for the Homeless Program directly to confirm whether their information was involved.

Why the ten-month gap stands out

State notification rules allow organisations time to investigate and determine the scope of an incident. A 307-day gap between the October 31, 2025 incident date and the September 03, 2026 filing is longer than most. The filing itself offers no explanation for the interval, and no discovery date is provided. Readers are left to weigh that timeline against their own risk tolerance.

What cannot be changed and what still can

The personal information listed in this filing cannot be altered the way a compromised password or credit card can. Once it is out, it remains usable by whoever obtained it. What you can control is how closely you monitor the downstream effects of that exposure.

Medical-related personal data in particular creates a persistent risk of insurance fraud and identity theft that lasts far longer than a typical retail breach. Thieves do not need your Social Security number to cause damage when they already hold enough contextual personal information from a healthcare provider.

Practical steps that address this specific exposure

• Place a fraud alert or credit freeze with the three major credit bureaus. This is the single most effective step for anyone whose personal information reached an unknown party. It forces lenders to verify your identity before opening new accounts.
• Review every Explanation of Benefits statement from your health insurer. Look for claims you did not receive care for. Medical identity theft often surfaces first as phantom bills or services you never used.
• Monitor your credit reports weekly for the next 12 months. Free weekly reports are available from AnnualCreditReport.com. Watch for addresses, employers, or inquiries you do not recognise.
• Contact Boston Health Care for the Homeless Program if you moved after October 31, 2025. Ask them directly whether your record was part of the incident. Their last-known address may not match your current one.
• Be wary of unsolicited calls or messages claiming to be from your insurer or this provider. Use phone numbers you look up yourself rather than numbers left in voicemail. The exposed personal details make convincing social-engineering attacks easier.

This incident is limited to the personal information category disclosed in the filing. No evidence suggests passwords or account credentials were involved. The long notification timeline is the most notable fact the record provides. For those who receive the letter, the exposure is real and permanent, but the immediate steps above remain effective at limiting what thieves can do with it.