University of Central Arkansas Community Care Clinic reports data breach

CONWAY -- The University of Central Arkansas disclosed Thursday that its Community Care Clinic experienced a data breach in September that exposed an undisclosed number of email addresses.

According to a notice issued by the clinic, unauthorized activity was discovered in its computer systems Sept. 28. A subsequent investigation determined that an unauthorized third party had access to one of the clinic's IT systems between Sept. 4 and Sept. 28.

The clinic discovered on Sept. 28 and confirmed on Sept. 29 that a file containing email addresses had been accessed or acquired. University officials said medical records, credit card information and financial account numbers were not involved in the breach.

In its notice Thursday, the clinic warned the incident may have resulted in recipients receiving phishing emails, fraudulent messages designed to trick people into revealing sensitive information, such as passwords or financial details, or clicking malicious links.

Officials said they "deeply regret" the incident and have notified the U.S. Department of Health and Human Services, as required by law.

The cause of the breach and how the unauthorized party gained access to the clinic's systems remained unclear Thursday. UCA officials did not immediately respond to requests for .

The clinic said it has secured its systems, removed unauthorized access and enhanced its network security controls, monitoring capabilities and access protocols. University officials also said staff have undergone specialized cybersecurity awareness retraining.

The clinic encouraged recipients to change their email account passwords and remain vigilant for potential phishing attempts.

The Community Care Clinic, located on UCA's Conway campus, provides primary care, mental health counseling, physical and occupational therapy, among other services, to central Arkansas residents. The clinic, which is overseen by UCA, also serves as a training facility for university students pursuing health-related degrees.

The incident comes amid a recent increase in ransomware attacks targeting educational institutions. According to an October analysis by cybersecurity research firm Comparitech, ransomware attacks against colleges and universities worldwide increased 88% from the second to third quarter of 2026.

Earlier this month, a ransomware group claimed to have stolen more than 500 gigabytes of student, employee and financial data from Philander Smith University, a private historically Black university in Little Rock. The allegations have prompted an investigation into a potential class-action lawsuit, although the university has not publicly confirmed a breach occurred.

Anyone seeking additional information or who believes they be impacted by the breach are asked by school officials to the Community Care Clinic.

Tarek Anthony can be reached by email at [email protected].