CHC Solutions, Inc. data breach

What we know

CHC Solutions, Inc. operates as a specialized national healthcare services and medical equipment provider, delivering vital medical supplies, durable medical equipment (DME), and in-home patient care support systems to individuals with chronic conditions, disabilities, and complex medical needs. Because of its central role in coordinating patient care and fulfilling physician-ordered medical supplies, the company maintains extensive repositories of highly sensitive protected health information. This includes complete patient profiles, detailed clinical histories, physician prescription orders, health insurance policy details, billing records, and government-issued identification, making it a critical custodian of confidential medical and personal data.

In 2025, official disclosures submitted to the Maryland Attorney General revealed that CHC Solutions, Inc. suffered a significant cybersecurity incident, compromising the security of its digital infrastructure and exposing confidential records. While specific technical forensics continue to emerge, incidents impacting healthcare supply chain organizations typically involve unauthorized network intrusions, sophisticated ransomware deployments, or vulnerabilities within third-party vendor applications. These attacks often target legacy databases and administrative platforms where vast amounts of centralized patient and client data are stored without adequate multi-layered segmentation.

The nature of the data compromised in the CHC Solutions breach exposes victims to severe, long-term risks that extend far beyond standard identity theft. Exposed elements such as full names, dates of birth, Social Security numbers, medical record numbers, health insurance identifiers, and detailed prescription information can be exploited by malicious actors for medical identity theft, fraudulent insurance billing, and targeted phishing schemes. When cybercriminals obtain clinical and treatment-related data alongside financial identifiers, victims face the alarming prospect of compromised medical histories, unauthorized prescription fulfillments, and complex financial fraud that can take years to resolve.

As a healthcare-related entity handling protected health information, CHC Solutions, Inc. was bound by stringent federal and state regulatory frameworks, most notably the Health Insurance Portability and Accountability Act (HIPAA) Security and Privacy Rules, as well as Maryland consumer protection laws. These legal mandates require covered entities and their business associates to implement robust administrative, physical, and technical safeguards—including advanced encryption, continuous network monitoring, and routine vulnerability assessments—to prevent unauthorized data exposure. The occurrence of a widespread data breach strongly suggests a potential failure in upholding these mandatory security standards, leaving confidential systems vulnerable to exploitation.

Receiving a data breach notification letter from CHC Solutions, Inc. serves as formal legal acknowledgment that your confidential information was compromised due to inadequate data security practices. Under established class action jurisprudence, affected individuals possess legal standing to pursue compensation and demand institutional accountability for the distress, increased risk of identity theft, and time spent mitigating potential fraud. Importantly, victims do not need to prove that financial loss has already occurred to participate in a legal claim. Our firm investigates these matters on a contingency fee basis, meaning affected consumers pay zero upfront costs and owe no legal fees unless we successfully recover compensation on their behalf.

See every breach reported in Maryland or read what to do after a ransomware attack.