Hispanic Counseling Center, a mental health and community services organization serving the Latino community on Long Island, New York, has notified people about a data security incident at its electronic medical records vendor. Reports on the filing say Social Security numbers and medical records were involved.
This page summarizes the public information about the incident based on the center’s sample notice letter and a summary of its state filing.
Hispanic Counseling Center’s Data Breach Investigation
Hispanic Counseling Center, often shortened to HCC, provides mental health and community support services on Long Island. Like many healthcare providers, it relies on an outside company to store and manage patient records electronically. The company in this case is Accumedic Computer Systems, which HCC describes in its notice letter as its electronic medical records vendor. The incident described in the letter took place at Accumedic, not at HCC’s own network.
According to the sample notice letter, which is dated October 30, 2026, Accumedic told HCC that it became aware of suspicious activity on its network on June 8, 2026. Accumedic says it isolated the affected servers right away, notified law enforcement, and started an investigation with help from outside experts. The letter states that the investigation and review finished on August 7, 2026.
The investigation found that an unauthorized third party got into Accumedic’s systems on or around April 8, 2026. The letter says that party potentially obtained customer information between June 4 and June 8, 2026. Put together, that means the intruder may have had access to Accumedic’s systems for around two months before the suspicious activity was noticed, according to the dates in the letter.
On September 1, 2026, Accumedic confirmed to HCC that the files involved may have contained personal information about HCC’s clients. HCC’s letters followed on October 30, 2026. The notice does not say how many people were sent a letter. It also does not say whether other healthcare providers that use Accumedic were affected, and no total count has been published, so this page does not offer one.
The letter says that HCC has no evidence of fraud or attempted or actual misuse of any information involved, and that it is sending notices out of an abundance of caution. It says Accumedic took steps to secure its network, carried out an investigation, and put additional technical safeguards in place. HCC says it is offering a period of complimentary identity protection and credit monitoring, and that people must enroll themselves because HCC cannot enroll them. In the sample copy, the length of that offer is left as a placeholder rather than a real figure, so it is not stated here. The letter lists a call center number, 1-833-918-4082, available Monday through Friday from 9:00 a.m. to 9:00 p.m. Eastern Time, excluding U.S. holidays.
The sample letter also leaves the list of data elements as an unfilled field, so it does not itself say what each person’s information included beyond a first and last name. A report on the incident’s filing with Massachusetts regulators, as summarized by ClassAction.org, lists Social Security numbers and medical records. Each recipient’s actual letter may name different items, since the data involved often varies from person to person.
Records from a mental health provider can be especially sensitive. They may reveal that a person sought care, what kind of care they received, and other details that people reasonably expect to stay private. When medical records are exposed together with a Social Security number, the risk goes beyond ordinary identity theft. The information can be used to impersonate a patient or to file false insurance claims, and the private nature of the records can itself cause harm. These points are general ones about the type of information that was reported, not findings about what happened to any particular person’s records.
Vendor incidents like this one are common in healthcare. A single electronic records company may hold files for many providers, so a problem at that company can lead to notices from several different organizations. Anyone who gets a letter from HCC should keep it and take the steps outlined in the letter.
When Did This Breach Occur?
According to the notice letter, an unauthorized party got into Accumedic’s systems on or around April 8, 2026 and potentially obtained customer information between June 4 and June 8, 2026. Accumedic became aware of suspicious activity on June 8, 2026.
The vendor’s investigation finished on August 7, 2026, and Accumedic confirmed to HCC that personal information may have been in the affected files on September 1, 2026. HCC’s letter is dated October 30, 2026.
What Information Was Breached?
The sample letter says the information may have included a first and last name together with other data elements, but the list of elements is left blank in the copy available. A report on the Massachusetts filing, as summarized by ClassAction.org, says Social Security numbers and medical records were involved.
The company has not published a full list for every person. Your own notice letter is the best source for what applies to you.
What You Can Do
If you received a notice from Hispanic Counseling Center or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with the enrollment details for any free credit monitoring it offers. You must enroll yourself.
- Place a free fraud alert or credit freeze with Equifax, Experian and TransUnion, and get your credit reports free at annualcreditreport.com.
- Review bank, card and health insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Hispanic Counseling Center
If you received a notice from Hispanic Counseling Center, you may have legal options. A data breach lawsuit can seek compensation for the loss of privacy, the time spent protecting yourself and any out-of-pocket costs, and can press a company to improve how it safeguards personal information. Whether a claim makes sense depends on the facts of the incident, some of which have not been made public. Keep your notice letter and any records of suspicious activity or expenses, since they may matter later.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
