COMHAR Data Breach: Treatment Notes and SSNs Copied, No Lawsuit Filed Yet
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
COMHAR, a Philadelphia nonprofit for behavioral health, intellectual disability, HIV/AIDS and home health services, says an unknown actor copied files from its network on or before July 17, 2026. Its notice of September 4, 2026 lists Social Security numbers, diagnoses, medications and treatment notes as possibly exposed. As of October 11, 2026, no COMHAR data breach lawsuit has been filed that we could find — only law-firm investigations. There is no settlement and no claim form.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened in the COMHAR Data Breach
COMHAR, Inc. was founded in 1975 and serves the greater Philadelphia area. According to its own Notice of Data Event dated September 4, 2026, it identified unusual activity on its network and brought in third-party specialists. On July 17, 2026, that investigation determined that certain files and folders had been copied by an unknown actor on or before that date.
The notice lists the information that may be involved: name, address, date of birth, Social Security number, treatment notes, diagnosis, medications and health insurance information. For a behavioral-health provider, treatment notes and diagnoses are among the most sensitive records there are.
COMHAR says its review of the copied files “is currently ongoing,” so the exact fields for each person may not yet be known. A breach-tracking site reports that a ransomware group claimed on the dark web on July 1, 2026 to hold COMHAR data. That is the group's own claim; COMHAR's notice does not name anyone.
Case Details
No lawsuit has been filed that we could verify. As of October 11, 2026, a search of federal court records on CourtListener for “COMHAR” and “breach” returned no data breach case against COMHAR. The federal cases that do name COMHAR are older employment and disability matters in the Eastern District of Pennsylvania, such as Kramer v. COMHAR, No. 2:19-cv-01253 — unrelated to this incident.
What exists instead are attorney investigations: one law-firm page published September 9, 2026 says attorneys are looking into “whether a class action lawsuit can be filed.” We did not search Pennsylvania state-court dockets, so a filing in the Philadelphia Court of Common Pleas cannot be ruled out.
Status: Breach Disclosed, No Lawsuit, No Settlement
COMHAR has not published how many people are affected. A breach-tracking site reports that the incident was reported to the U.S. Department of Health and Human Services, but we could not confirm a count on the federal breach portal. If a number appears there or a complaint is filed, this page will be updated with the date.
Who May Be Affected
The notice is addressed to “individuals who may have been impacted.” It does not say whether those are current clients, former clients, employees or others. Given what COMHAR does, the people most likely to be in the copied files are those who received its behavioral health, intellectual disability, HIV/AIDS or home health services.
The practical test is direct contact from COMHAR. Keep any letter you receive; it should say which of your data fields were involved. If you are unsure, COMHAR's own helpline is 1-888-941-5180, Monday through Friday, 8:00 AM to 8:00 PM ET, excluding holidays, or write to COMHAR at 100 W. Lehigh Ave, Philadelphia PA 19133.
There is nothing to join. If a class action is ever filed and certified or settled, a court-appointed administrator notifies class members.
Is There Money? Not Now
For context only, not a prediction: health-data breach settlements have typically combined reimbursement of documented losses, a smaller flat cash payment and credit monitoring. The Integris Health settlement in Oklahoma, for example, set up a $30 million fund and offered up to $25,000 for documented losses or an estimated $100 flat payment. Whether a COMHAR case ever reaches that point is unknown. Our data breach settlement calculator shows how comparable cases have paid.
COMHAR Data Breach Timeline
- 1
July 1, 2026 — Dark-Web Claim Reported
A breach-tracking site reports that a ransomware group posted a claim to hold COMHAR data and threatened to publish it. COMHAR has not confirmed who was responsible.
- 2
July 17, 2026 — Copying Confirmed
COMHAR's investigation determines that files and folders were copied by an unknown actor on or before this date. A review of the copied files begins.
- 3
September 4, 2026 — Public Notice
COMHAR publishes a Notice of Data Event in Philadelphia listing SSNs, treatment notes, diagnoses, medications and insurance data as possibly exposed. The review is still ongoing.
- 4
September 9, 2026 — Attorneys Start Investigating
A law-firm page invites affected people to come forward while attorneys assess whether a class action can be filed. This is recruitment, not a lawsuit.
- 5
October 11, 2026 — No Federal Case Found
A federal docket search shows no COMHAR data breach case. No count of affected people has been published.
- 6
Next — Watch for a Complaint or a Count
The next concrete events would be a filed complaint with a court and case number, or a published number of affected people. Neither existed as of October 11, 2026.
Three Things to Watch For
A breach with mental-health records, no count and no lawsuit leaves room for people who sound official:
“Claim your COMHAR settlement” pages
There is no settlement and no claims portal. A site asking for your Social Security number or bank details to “secure your payment” is collecting data, not filing a claim. The FTC has warned that consumers never have to pay to file a settlement claim.
Threats to publish your treatment records
The attackers reportedly threatened to publish stolen data. If anyone contacts you demanding money to keep your diagnosis or treatment notes private, do not pay or engage — report it to COMHAR at its helpline and to the FBI's IC3.
Callers posing as COMHAR
A caller who knows you were a client may still be a fraudster. Hang up and call COMHAR's published number, 1-888-941-5180, yourself. The FTC warns that an unsolicited call pushing you to file a claim is almost certainly a scam.
COMHAR Data Breach — Questions People Actually Ask
Is there a COMHAR data breach lawsuit?
Not that we could find as of October 11, 2026. Federal court records show no COMHAR data breach case, and the only legal activity reported is attorneys investigating whether a class action can be filed. We did not search Pennsylvania state-court dockets.
What data was exposed in the COMHAR data breach?
Per COMHAR's notice, possibly name, address, date of birth, Social Security number, treatment notes, diagnosis, medications and health insurance information. The review was still ongoing, so your letter is the best guide to your own record.
How many people were affected?
COMHAR has not published a number. Its notice says the review of the copied files is ongoing, and we could not confirm a count on the federal health-breach portal as of October 11, 2026.
How do I know if I was part of a data breach?
For this incident, COMHAR is notifying individuals who may have been impacted, so a letter from COMHAR is the clearest sign. You can also call its helpline at 1-888-941-5180, Monday through Friday, 8:00 AM to 8:00 PM ET.
Are data breach settlements legit?
Real settlements exist, but there is no COMHAR settlement. A genuine settlement is run by a court-appointed administrator and never charges a fee to file; the FTC has said consumers will never have to pay to file a claim.
How much is the Integris data breach settlement?
That is a different case: Integris Health, an Oklahoma health system, agreed to a $30 million settlement over a 2023 breach affecting more than 2.38 million people. It has nothing to do with COMHAR, and this page cannot help with an Integris claim — check that settlement's official notice instead.
Do I need to sign up somewhere?
No. There is no case or settlement to join. Contacting a law firm is your choice, not a registration step; if a class action is ever certified or settled, class members are notified directly.
What should I do right now?
COMHAR's notice recommends reviewing credit reports, account statements and explanation of benefits forms, and placing a fraud alert or credit freeze with TransUnion, Experian and Equifax. A freeze is free and reversible.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Open Class Action Settlements
Settlements currently accepting claims, with deadlines
Data Breach Settlement Calculator
What comparable breach settlements have paid per person
Change Healthcare Data Breach
The largest health-data breach case and where it stands
Settlement Payout Calculator
Estimate a per-person share once a fund exists