{"id":"unlimited-systems-patient-data-breach-jul-2026","category":"breach","status":"closed","title":"Unlimited Technology Systems breach exposes sensitive information of about 3.8 million patients","tldr":"Attackers copied patient information from healthcare software provider Unlimited Technology Systems, affecting about 3.8 million people. If notified, check your letter’s identity-monitoring deadline, review your credit reports and consider credit freezes.","summary":"An October 2025 intrusion at Unlimited Technology Systems, a US healthcare billing and practice-management software provider, exposed information about patients of its healthcare clients. The company found evidence of copying between 5 and 10 October and later confirmed ransomware encryption to Becker’s. Depending on the person, affected information could include diagnoses, Social Security numbers, insurance details, contact information and scanned identity documents. Unlimited excluded complete medical records, medical images and payment-card or bank-account information. HIPAA Journal reported a federal total of 3,803,750; Indiana’s October register lists 3,836,316, without explaining the difference. Unlimited’s filing dates notifications to about 21 July 2026, while Almeida’s report says about 1 July. The company strengthened security, offered two years of identity monitoring and said it knew of no attempted or actual misuse. Related lawsuits were consolidated on 27 August. As of 3 November, the reviewed sources do not establish recovery of the copied data, a settlement or a final litigation outcome. There is no patient software update to install.","action":"If you receive a notice, follow its instructions for the free two-year Kroll identity-monitoring offer before your individual activation deadline, or call 844-576-3063 with questions. Review your credit reports and account statements, report unfamiliar activity promptly, and consider freezing your credit separately with Equifax, Experian and TransUnion.","product":"Unlimited Technology Systems healthcare billing and practice-management services","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["unlimited-systems","healthcare","data-breach","ransomware","identity-theft","patient-data"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Unlimited Technology Systems notification to the Iowa Attorney General and sample patient notice","url":"https://www.iowaattorneygeneral.gov/media/cms/7212026_Unlimited_Technology_System_0B86CFE2EF213.pdf","by":"Unlimited Technology Systems","date":"2026-07-21"},{"kind":"advisory","title":"Notice of Data Breach — sample individual notice","url":"https://oag.ca.gov/system/files/Unlimited%20-%20Exhibit%20A%20-%20Sample%20Individual%20Notice.pdf","by":"Unlimited Technology Systems","date":""},{"kind":"news","title":"Unlimited Technology Systems Data Breach Affects 3.8 Million Patients","url":"https://www.hipaajournal.com/patient-data-exposed-ohio-revenue-cycle-management-company/","by":"HIPAA Journal","date":"2026-08-06"},{"kind":"news","title":"Ransomware attack at health IT vendor exposes 442,000 patients’ data","url":"https://www.beckershospitalreview.com/healthcare-information-technology/cybersecurity/ransomware-attack-at-health-it-vendor-exposes-442000-patients-data/","by":"Becker’s Hospital Review","date":"2026-07-29"},{"kind":"post","title":"Unlimited Technology Systems, LLC Data Breach Investigation","url":"https://www.almeidalawgroup.com/data-breach-news/unlimited-technology-systems-llc-data-breach-investigation/","by":"Almeida Law Group","date":"2026-07-21"},{"kind":"post","title":"In re Unlimited Technology Systems Data Breach Litigation — docket retrieved 27 August 2026","url":"https://dockets.justia.com/docket/ohio/ohsdce/1:2026cv00712/314237","by":"Justia","date":"2026-08-27"},{"kind":"post","title":"October 2026 year-to-date data breach report","url":"https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-October-Year-to-Date-Report-2026.pdf?trk=article-ssr-frontend-pulse_little-text-block","by":"Indiana Attorney General","date":""},{"kind":"post","title":"2026 Security Breach Notifications","url":"https://www.iowaattorneygeneral.gov/for-consumers/security-breach-notifications/2026-security-breach-notification","by":"Iowa Attorney General","date":""}],"started":"2026-07-01","closed":"2026-08-27","created":"2026-11-03T20:34:04.217Z","updated":"2026-11-03T20:34:04.217Z","cve_notes":[],"timeline":[{"at":"2026-08-27","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"The court consolidated ten related cases as In re Unlimited Technology Systems Data Breach Litigation and appointed interim counsel. Justia’s available docket ends with this order.","url":"https://dockets.justia.com/docket/ohio/ohsdce/1:2026cv00712/314237","by":"Justia","patch":null},{"at":"2026-08-06","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"HIPAA Journal reported that the federal health-data breach register listed 3,803,750 affected individuals, establishing the scale of the breach.","url":"https://www.hipaajournal.com/patient-data-exposed-ohio-revenue-cycle-management-company/","by":"HIPAA Journal","patch":null},{"at":"2026-07-29","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Unlimited confirmed to Becker’s that ransomware encrypted systems hosting its g4-Centricity for Vector platform, prompting it to suspend access. The company said it had notified affected customers and had no evidence of data misuse.","url":"https://www.beckershospitalreview.com/healthcare-information-technology/cybersecurity/ransomware-attack-at-health-it-vendor-exposes-442000-patients-data/","by":"Becker’s Hospital Review","patch":null},{"at":"2026-07-22","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Glenn Watts filed a complaint against Unlimited in the US District Court for the Southern District of Ohio.","url":"https://dockets.justia.com/docket/ohio/ohsdce/1:2026cv00712/314237","by":"Justia","patch":null},{"at":"2026-07-21","added":"2026-11-03T20:32:12.437Z","kind":"disclosed","text":"Unlimited’s Iowa filing says patient notifications began around this date and were being mailed in batches. It offered notified individuals 24 months of free identity monitoring and said approximately 162,478 Iowa residents would receive notices.","url":"https://www.iowaattorneygeneral.gov/media/cms/7212026_Unlimited_Technology_System_0B86CFE2EF213.pdf","by":"Unlimited Technology Systems","patch":null},{"at":"2025-10-19","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Unlimited discovered unauthorised activity, hired forensic investigators and notified law enforcement.","url":"https://oag.ca.gov/system/files/Unlimited%20-%20Exhibit%20A%20-%20Sample%20Individual%20Notice.pdf","by":"Unlimited Technology Systems","patch":null},{"at":"2025-10-05","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"An attacker copied personal information from Unlimited Technology Systems’ commercial data centre between 5 and 10 October, according to the company’s subsequent investigation.","url":"https://oag.ca.gov/system/files/Unlimited%20-%20Exhibit%20A%20-%20Sample%20Individual%20Notice.pdf","by":"Unlimited Technology Systems","patch":"na"}],"url":"https://hard.fyi/live/unlimited-systems-patient-data-breach-jul-2026/","json":"https://hard.fyi/api/live?id=unlimited-systems-patient-data-breach-jul-2026"}