Was the College of Health Care Professions (CHCP) Breached? Houston Class Actions

Yes — The College of Health Care Professions (CHCP) was breached. The Houston allied-health college — legal entities Empowerment Schools – Healthcare Ltd and Texas Medical Careers, Limited — filed with the Texas Attorney General on March 27, 2026, reporting 68,927 Texas residents affected. Notice went out by U.S. Mail and was also posted on the company website.

Reporting describes unauthorized network access around August 16–20, 2025, with personal (and potentially medical / insurance) data confirmed later before 2026 consumer notices. Proposed class actions in the U.S. District Court for the Southern District of Texas include Johnson v. Empowerment Schools Healthcare… d/b/a The College of Health Care Professions (4:26-cv-01747, filed March 3, 2026), with member cases directed to that lead.

We scanned chcp.edu to assess email and domain security posture relevant to student-notice spoofing and portal phishing.

What Happened

According to Texas OAG records, school notices, and CourtListener RECAP dockets:

• August 16–20, 2025 — Unauthorized third-party access to CHCP network systems (reported window).
• August 21, 2025 — Suspicious activity discovered; systems isolated (school notice accounts).
• January 30, 2026 — Review confirms personal information may have been in accessed / downloaded files.
• February–March 2026 — Consumer mail notices and website posting; Texas OAG lists 68,927 Texans (March 27, 2026).
• March 3, 2026 — Lead federal suit 4:26-cv-01747 (S.D. Tex); related cases consolidated under that lead.

Breach Impact at a Glance

Data at Risk

Texas OAG records list exposed categories including:

• Names, addresses, dates of birth
• Social Security numbers
• Driver’s license / government-issued ID numbers
• Financial account information
• Medical information and health insurance information

Because medical and insurance fields appear alongside SSNs, affected students, employees, and relatives face both identity theft and healthcare-targeted phishing risk.

Independent Cybersecurity Audit

We ran an EmailMeNow Cybersecurity Audit of chcp.edu on August 4, 2026:

Key findings:

• 60% overall (Above Average) — still well below the 100% ideal for a school holding student SSN and health-adjacent records.
• 70% Identity & Spoofing — better than many peers, but not full DMARC enforcement toward 100%.
• 15% Transport Security — missing MTA-STS enforcement leaves mail-path downgrade risk during notice campaigns.
• 37% Website Security — public web hardening lags identity scores; portal phishing remains a concern.

Audit link: chcp.edu audit

Lookalike domains

A cybersquat scan of chcp.edu found registered brand-adjacent hosts including chcp.com, chcp.net, and chcp.org (NS/A and often MX). Prefer the school’s published notice URLs; treat unexpected “CHCP portal” domains as phishing risk — see Cybersquat Domain Monitoring. (Short .edu omissions like ccp.edu / chp.edu are often unrelated institutions — do not assume they are CHCP lookalikes.)

Email blacklist check

MX/domain DNSBL check on August 4, 2026: clear on checked mail/domain lists (public DoH). Some Spamhaus/URIBL rows were unavailable via public resolvers — verify on check.spamhaus.org if deliverability is in dispute.

Website stack probe — chcp.edu

We checked what chcp.edu publicly reveals about its website software on August 4, 2026:

Bottom line: no CMS/version string was exposed to the passive probe. That does not mean the stack is hardened — only that public cues were thin. Pair TLS hygiene with the email-audit gaps above (15% transport) during the student-notice window.

Priority Actions

If you received a CHCP / Empowerment notice:

• Use only the enrollment URL or phone number printed in your letter for credit monitoring.
• Treat unexpected “CHCP portal” or financial-aid emails as suspicious until verified out-of-band.

For healthcare education operators:

• Pair DMARC enforcement with MTA-STS mode=enforce and harden student-portal headers toward the 100% ideal.
• Minimize retention of SSN + medical data on the same network segments used for marketing mail.

Related Trackers

• Texas breach-litigation defendants email-security scoreboard
• Gulshan Management Qilin breach litigation
• Mobilelink breach litigation
• Earthbound Holding breach litigation
• Texas healthcare breaches 2026
• Healthcare AG breach reports 2026
• Texas OAG YTD dashboard
• All state AG trackers

Run a free Instant Cybersecurity Audit at audit.emailmenow.com or contact EmailMeNow IT Consulting for education-sector email and portal hardening.

Sources: Texas OAG — Data Security Breach Reports · CourtListener — Johnson v. Empowerment Schools Healthcare (CHCP) · EmailMeNow audit — chcp.edu