Loading story…
ApolloMD, a US-based healthcare services and practice management provider and HIPAA business associate, disclosed that a May 2025 cyberattack led to unauthorized access to its IT environment and potential theft of patient data affecting 626,540 individuals. ApolloMD reported detecting unusual activity on May 22, 2025, and its investigation concluded an unauthorized party accessed systems between May 22–23, 2025, including files tied to patients treated by affiliated physicians and practices; the incident was later reflected in US HHS breach reporting.
Exposed data varied by individual but included names, dates of birth, addresses, diagnoses, treatment details/dates of service, provider names, health insurance information, and for some, Social Security numbers. Reporting also linked the incident to the Qilin ransomware group, which publicly listed ApolloMD on its leak site in June 2025 and claimed exfiltration of 238 GB (posting limited proof screenshots not showing patient data); ApolloMD’s public notice did not confirm ransomware, encryption, or a ransom demand. ApolloMD notified affected client practices between July–September 2025, issued patient letters in mid-September 2025, and posted a substitute notice later that month, including a list of impacted managed physician practices.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
By 2026-02-12, ApolloMD had published a public substitute notice describing the May 2025 incident and the affected data. The notice did not mention ransomware, encryption, or any ransom demand.
ApolloMD later reported the breach to the US Department of Health and Human Services, disclosing that 626,540 individuals were affected. This formal reporting established the scale of the incident in public breach records.
ApolloMD began sending notification letters to affected patients on 2025-09-17. The notices said the incident may have exposed varying combinations of personal and protected health information, including Social Security numbers in some cases.
Between 2025-07-21 and 2025-09-11, ApolloMD notified its managed physician practices and client organizations about the breach. These notifications concerned potential exposure of patient information tied to affiliated physicians and practices.
On 2025-06-12, the Qilin ransomware group publicly claimed responsibility for the ApolloMD incident. The group alleged it had exfiltrated 238 GB of data and posted limited proof screenshots, though no patient data dump was apparent.
ApolloMD identified unusual activity in its IT environment on 2025-05-22, engaged a digital forensics firm, and notified law enforcement. The company later determined unauthorized access occurred between 2025-05-22 and 2025-05-23.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple U.S. healthcare organizations reported **unauthorized network access and patient data exposure**, with several incidents involving confirmed **data exfiltration** and follow-on notification/credit-monitoring actions. **QualDerm Partners** disclosed unauthorized access between **Dec. 23–24, 2025** with files exfiltrated and notifications being sent on a rolling basis, while **Carolina Foot & Ankle Associates** reported a **Dec. 2025** intrusion detected after a network disruption and confirmed exfiltration of files containing PHI (e.g., demographics, MRNs, insurance data, and treatment/billing codes). Additional breach disclosures included **Cedar Point Health** (intrusion detected around **June 16, 2025**, with a months-long data review concluding in late Jan. 2026 and impacted data potentially including SSNs/ITINs and government IDs) alongside separate notifications from **Wee Care Pediatrics** and **Easterseals Northeast Indiana**. Legal and regulatory consequences continued to surface from earlier healthcare incidents. **Asheville Eye Associates** agreed to settle consolidated class-action litigation tied to a **Nov. 2024** attack claimed by **DragonForce ransomware**, which allegedly exfiltrated **~540 GB** before encrypting systems and later leaked data when ransom was not paid; the breach was reported to HHS OCR as affecting **204,984** individuals. Sector-wide reporting also indicated **46** large healthcare breaches logged for **Jan. 2026** on the HHS OCR portal (500+ individuals), exposing **~1.44 million** individuals’ PHI, amid discussion that late-2025 reporting backlogs may have influenced recent month-to-month trends.
Jun 29, 2026
Medical Computer Business Services (MCBS), a Georgia-based medical billing and practice-management firm, disclosed that a September 2025 network intrusion exposed the personal, insurance, and medical information of **1,261,464 individuals**. The company said unauthorized actors accessed its systems between **September 22 and September 26, 2025**, and that the compromised data may include names, addresses, Social Security numbers, dates of birth, insurance identifiers, medical histories, diagnoses, and treatment details. MCBS reported that the affected records were tied to data it managed for **seven healthcare organizations**. The incident has been linked to the **PEAR ransomware** group, which claimed responsibility shortly after the intrusion and alleged it stole more than **3 TB** of data, including patient `PII`/`PHI`, financial records, HR documents, payment information, and emails. MCBS said its investigation concluded on **May 28, 2026**, while U.S. Department of Health and Human Services breach-tracker data lists the event among major healthcare breaches, underscoring the scale of the exposure and the risk to patients and partner providers.
Jul 30, 2026
**General Physician, P.C.** agreed to pay **$2.5 million** to settle consolidated class-action litigation tied to a **2024 email-environment compromise** that exposed sensitive patient data. The organization detected suspicious activity on **June 12, 2024**, and a forensic investigation found an unauthorized party had accessed its email system from **April 6 to June 12, 2024**. Potentially exposed data included **SSNs, financial account information, dates of birth, medical and treatment details, diagnoses, medical record numbers, and insurance information**; the affected population was later updated to **167,387 individuals** (after an initial placeholder report of 501 to HHS OCR). The settlement fund is intended to provide class benefits after fees/expenses, and the company did not admit wrongdoing. Two additional California healthcare providers reported separate security incidents involving unauthorized access to systems containing patient information. **Valley Radiology Consultants Medical Group** identified a breach on **September 15, 2025**, engaged third-party incident response support, confirmed unauthorized access to its network and files, and began mailing notifications after completing file review on **February 18, 2026**; it also offered **12 months of credit monitoring** and reported taking remediation steps (e.g., password changes and security enhancements). **Nephrology Associates Medical Group** separately began notifying patients about a cyberattack first identified on **May 20, 2025** (details in the provided excerpt are truncated), indicating another healthcare-sector intrusion with patient data exposure risk.
Jun 29, 2026