Colorado Health Network Confirms Ransomware Breach 10 Months After Hackers Leaked HIV Patient Data

The hackers told the world before the victims did.

Colorado Health Network (CHN) provides holistic support services for people affected by HIV across Colorado. In late June 2026, it confirmed what a ransomware group had been advertising for nearly a year: an unauthorized actor had broken into its network and copied sensitive files.

The first public sign of trouble didn’t come from CHN. It came from the attackers. On August 28, 2025, a ransomware operation calling itself Cephalus posted CHN to its dark-web data-leak site, claiming it had exfiltrated more than 900 GB of data. The same crew has claimed a string of other victims, including a yacht company, a law firm, and a pregnancy-care network a reminder that these groups don’t discriminate by industry.

CHN’s own investigation eventually confirmed that an attacker had “accessed and acquired” files on its network. Yet the formal notifications to affected individuals didn’t begin going out until June 18, 2026 close to 10 months after the data was already being shopped on the dark web. CHN has not publicly disclosed how many people in total were affected; a filing to the Texas Attorney General listed 257 Texas residents, which is almost certainly a small slice of the real number.

A long silence over very sensitive data

What was exposed

This is the combination that makes a healthcare breach so much more damaging than a stolen credit card. A card can be cancelled overnight. A diagnosis, a Social Security number, and a passport number cannot and when the diagnosis touches a stigmatized condition, the harm is not just financial but personal and permanent.

Why the delay is the story

Every day that passes between a breach and a notification is a day victims can’t protect themselves. They don’t freeze their credit, they don’t watch for fraudulent insurance claims, and they don’t brace for extortion because they don’t know anything happened. A 10-month head start is an enormous gift to criminals.

Long gaps like this usually aren’t the result of one bad decision. They’re the result of not knowing what was taken. When an organization lacks detailed logging and a tested incident-response plan, reconstructing which files were touched and which individuals were affected can drag on for months and the notification clock can’t really start until that work is done.

For any practice that holds protected health information, the lesson is direct: the time to figure out how you’d answer “what exactly did they take, and whose data was it?” is before an incident, not during one. The organizations that notify quickly are almost always the ones that invested in visibility ahead of time.

HIPAA timelines, state laws, and the lawyers already circling

Under HIPAA’s Breach Notification Rule, covered entities generally must notify affected individuals without unreasonable delay and no later than 60 days after discovery, and report large breaches to the U.S. Department of Health and Human Services. State breach-notification laws stack additional deadlines and penalties on top. A months-long gap invites hard questions from reguRobotors about when the breach was truly “discovered” and why notice took so long.

The plaintiffs’ bar is already moving. Multiple law firms have publicly announced class-action investigations into the CHN breach, soliciting affected individuals. Data-breach class actions now follow healthcare disclosures almost automatically, and a defendant that can’t show it took reasonable, documented security precautions is far more exposed when those suits are filed.

For a smaller practice, the math is sobering. You may not have CHN’s caseload, but you face the same federal rules, the same state deadlines, and the same lawyers with a fraction of the budget to absorb the fallout.

What your practice should do this week

1. Map where your sensitive records actually live. You can’t protect or quickly report on data you can’t find. Inventory every system, drive, and cloud folder holding patient PHI, financial data, and IDs, including old archives you’ve stopped using.
2. Turn on logging and exfiltration alerts. CHN’s attackers copied 900 GB out the door. Make sure your systems would flag large or unusual data transfers in minutes, so you’d know what was taken instead of guessing for months.
3. Write and test an incident-response plan. Decide now who you call, how you preserve evidence, and how you’ll meet the HIPAA 60-day notification clock. A plan you’ve rehearsed is the difference between a 60-day notice and a 10-month one.
4. Encrypt and tightly control access to PHI. Limit who can reach sensitive records, require multi-factor authentication, and encrypt data so that stolen files are far less useful to an extortionist.
5. Vet your vendors and backups. Confirm that anyone who touches your patient data has real security controls, and that you hold clean, offline backups you’ve actually tested restoring.

Trust is the asset. Silence spends it.

People hand a healthcare organization their most private facts on the assumption that those facts will be protected and that if something goes wrong, they’ll be told quickly enough to react. The Colorado Health Network breach broke both halves of that promise: the data got out, and the people it belonged to were among the last to know.

Your patients or clients extend you the same trust every day. The defense isn’t just better firewalls it’s the visibility to know fast what happened, and the plan to tell people honestly when it does. If you’re not confident your practice could answer “what did they take, and whose was it?” within days rather than months, that’s the gap worth closing now before the silence is yours to explain.