Central Jersey Medical Center FQHC Breach (2025): 131K Patient SSN & Home Address Records Exposed

About Central Jersey Medical Center

Central Jersey Medical Center, Inc. (CJMC) is a Federally Qualified Health Center based in Perth Amboy, New Jersey, with additional locations in Newark and Carteret. Serving the region since 2001, CJMC provides primary, specialty, and dental care to medically underserved populations regardless of insurance status or ability to pay. The organization operates several school-based health centers in Newark public schools that offer dental, medical, and mental health services to both students and the broader community. As a HIPAA-regulated FQHC, CJMC maintains comprehensive patient identity, contact, insurance, billing, and clinical records across its primary, dental, and mental-health operations, alongside school-program records and Medicaid and Medicare identifiers used for federal-program billing.

Why They Hold Your Data

Federally Qualified Health Centers collect patient identity, contact, insurance, billing, appointment, and clinical records across primary, dental, and preventive care services.

Recent Developments

Central Jersey Medical Center experienced a ransomware attack on August 25, 2025 in which an external threat actor gained unauthorized access to its dental servers' network and deployed ransomware to encrypt files. The Sinobi ransomware-as-a-service group claimed responsibility on October 10, 2025 by listing CJMC on its dark-web leak site and asserting it had exfiltrated approximately 930 gigabytes of data. CJMC posted a public notice on its website on October 23, 2025 and began notifying affected individuals. The organization engaged outside cybersecurity experts, notified law enforcement, and reported the matter to state and federal regulators. Class-action investigations by U.S. plaintiff law firms began organizing in late October 2025. CJMC has stated that its general electronic medical record system was not involved, and that no financial accounts or payment information was affected.

Data Points Exposed

Breach Impact

CJMC faces significant institutional exposure given its FQHC status and the size of the affected patient population. Federal HIPAA notification obligations, an active Office for Civil Rights review, federal grant-recipient compliance obligations, New Jersey attorney-general filings, and active class-action litigation discussions are all underway. The reputational impact is concentrated within underserved populations in Perth Amboy, Carteret, and Newark public schools where CJMC is often the only available local provider, making patient retention and trust unusually consequential. As an FQHC, CJMC operates with a limited cybersecurity budget and staffing relative to larger metropolitan hospitals, which is a known industry-wide vulnerability for community health centers. CJMC's confirmation that its general EMR system was not involved has helped contain the scope of disclosure obligations.

Exploitation & Downstream Threats

• Identity theft and synthetic identity construction using government-issued IDs | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure

What You Should Do

1. Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
2. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
3. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
4. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).