Data Security Incident

Community First Health Plans, Inc. (“Community First”) recently experienced a data security incident that affected the personal information, including protected health information, of a limited group of Community First members.

Community First has mailed a copy of the “notice of breach” letter below to affected members. That letter notifies them that they were impacted by this incident, explains what Community First is doing in response, and describes how to enroll in the 12 months of complimentary credit monitoring services Community First is providing to affected members. For a very small subset of affected members, Community First was unable to identify a current mailing address or other contact information.

If you did not receive a notice letter from Community First, but are concerned that your information may have been affected by this incident, you can email Community First at privacy@cfhp.com or call us at 800-434-2347, Monday to Friday from 8:00 a.m. to 5:00 p.m. Central Time, to learn whether you were affected, ask questions, and get information on how to access Community First’s free credit monitoring services.

If you were affected by this incident, we encourage you to read the notice of data breach below:

June 29, 2026
Re: NOTICE OF DATA BREACH

Dear [Affected Member Name],

Community First Health Plans, Inc. (“Community First,” “we,” “our,” “us”) is writing to inform you of a data security incident that involved some of your personal information, including protected health information.

We take the privacy and security of your personal information very seriously. Although we are not aware of any actual misuse of your information as a result of this incident, due to the sensitive nature of the compromised personal information, we are writing to inform you of the incident, to advise you of steps to further protect your personal information, and to offer you twelve (12) months of complimentary identity monitoring services.

What Happened? On April 30, 2026, we became aware of an April 29 incident where a Community First employee uploaded a file containing personal information of some Community First members to ChatGPT, an online large language model artificial intelligence service. Community First does not utilize ChatGPT, and the employee was only able to access ChatGPT by intentionally circumventing Community First firewall safeguards and violating Community First policy.

In response, we immediately launched an investigation, revoked the employee’s access to Community First systems, directed and verified that the employee had deleted all personal information from their ChatGPT account, and contacted OpenAI, LLC (the operator of ChatGPT) to demand deletion of any related data. Community First retrieved all personal information from the employee and promptly ended with its relationship with the employee. Importantly, and as stated above, we are not aware of any misuse of personal information, but the compromised information is sensitive in nature. Therefore, we encourage you to review the information provided herein, including the steps you can take to further protect your personal information.

What Information Was Involved? Based on our investigation, the following categories of information related to you may have been affected: name, address, date of birth, member identification number, and prescription drug information.

What We Are Doing. The privacy and security of your personal information is our priority. Upon discovering the incident, we took the immediate steps described above. In addition, we are working to implement authorized log-on time windows for our employees, and mandatory VPN connectivity to our systems at all times to prevent future firewall bypass. We have also revised relevant policies and procedures, retrained our workforce, and distributed additional reminders to all staff regarding the prohibition on the use of unauthorized artificial intelligence tools and the consequences of violating our policies. We will continue to implement additional safeguards in light of new technologies and best practices.

Finally, although we are not aware of any impacted information having been misused, we will be offering you complimentary identity monitoring services for twelve (12) months. A description of those services and instructions on how to enroll will be mailed to you separately. Please note that you will need to complete the enrollment process yourself, as we are not permitted to enroll you in these services on your behalf.

What You Can Do. You can follow the recommendations on the following pages to help protect your personal information. While we are not aware that anyone’s information has been misused as a result of this incident, as a precautionary measure to safeguard your information, we encourage you to activate the identity monitoring services that will be offered to you at no charge.

For More Information. Further information and resources regarding the protection of your personal information appear on the following pages. If you have questions or concerns about this, or if we can be of further assistance to you, please do not hesitate to email us at privacy@cfhp.com or call us at 800-434-2347 from 8:00 a.m. to 5:00 p.m. central time.

We take your trust in us very seriously and are committed to the privacy and security of your personal information. We sincerely apologize for the concern and inconvenience that this incident has caused.

 Sincerely,

Stephanie Morris
Executive Director, Compliance and Risk Management
Community First Health Plans, Inc.

Steps You Can Take to Protect Your Personal Information

Monitor Your Accounts

We encourage you to remain vigilant against incidents of identity theft and fraud at least over the next twelve to twenty-four months and promptly report any incidents of suspected identity theft to us. We also encourage you to promptly change any involved account passwords, and to review account statements, credit reports, and explanations of benefits forms for suspicious activity. Under U.S. law you are entitled to one free credit report annually from each of the three major credit reporting bureaus. To order your free credit report, visit www.annualcreditreport.com or call, toll-free, 1-877-322-8228. You may request to have information relating to any fraudulent transactions deleted.

You may also contact the three major credit bureaus directly to request a free copy of your credit report. You may wish to stagger your requests so that you receive a free report by one of the three credit bureaus every four months.

You have the right to place a “security freeze” on your credit report, which will prohibit a consumer reporting agency from releasing information in your credit report without your express authorization. The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a security freeze to take control over who gets access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, or any other account involving the extension of credit. Pursuant to federal law, you cannot be charged to place or lift a security freeze on your credit report. Should you wish to place a security freeze, please contact the major consumer reporting agencies listed below:

To request a security freeze, you will need to provide the following information:

1. Your full name (including middle initial as well as Jr., Sr., II, III, etc.);
2. Social Security number;
3. Date of birth;
4. If you have moved in the past five years, provide the addresses where you lived over the prior five years;
5. Proof of current address, such as a current utility bill or telephone bill;
6. A legible photocopy of a government-issued identification card (state driver’s license or ID card, military identification, etc.); and
7. If you are a victim of identity theft, include a copy of either the police report, investigative report, or complaint to a law enforcement agency concerning identity theft.

As an alternative to a security freeze, you have the right to place an initial or extended “fraud alert” on your file at no cost. An initial fraud alert is a one-year alert that is placed on a consumer’s credit file. Upon seeing a fraud alert display on a consumer’s credit file, a business is required to take steps to verify the consumer’s identity before extending new credit. If you are a victim of identity theft, you are entitled to an extended fraud alert, which is a fraud alert lasting seven years. Should you wish to place a fraud alert, please contact any one of the agencies listed below:

If you believe you are the victim of identity theft, you should contact the proper law enforcement authorities, including local law enforcement, and consider contacting your state attorney general and/or the Federal Trade Commission (“FTC”). You may obtain information from the FTC and the credit reporting agencies listed above about placing a fraud alert and/or credit freeze on your credit report. You may contact the FTC to obtain additional information about avoiding identity theft at the following:

Federal Trade Commission
Consumer Response Center
600 Pennsylvania Avenue NW
Washington, DC 20580
(877) IDTHEFT (438-4338)
www.ftc.gov/idtheft

The Federal Trade Commission also encourages those who discover that their information has been misused to file a complaint with them. You can obtain further information on how to file such a complaint using the contact information listed above. You have the right to file a police report if you ever experience identity theft or fraud. Please note that to file a report with law enforcement for identity theft, you will likely need to provide some proof that you have been a victim. Instances of known or suspected identity theft should also be reported to law enforcement and your state Attorney General.

This notice has not been delayed by law enforcement.