Unlimited Technology Systems breach exposes sensitive information of about 3.8 million patients
Attackers copied patient information from healthcare software provider Unlimited Technology Systems, affecting about 3.8 million people. If notified, check your letter’s identity-monitoring deadline, review your credit reports and consider credit freezes.
If you receive a notice, follow its instructions for the free two-year Kroll identity-monitoring offer before your individual activation deadline, or call 844-576-3063 with questions. Review your credit reports and account statements, report unfamiliar activity promptly, and consider freezing your credit separately with Equifax, Experian and TransUnion.
What’s happening
An October 2025 intrusion at Unlimited Technology Systems, a US healthcare billing and practice-management software provider, exposed information about patients of its healthcare clients. The company found evidence of copying between 5 and 10 October and later confirmed ransomware encryption to Becker’s. Depending on the person, affected information could include diagnoses, Social Security numbers, insurance details, contact information and scanned identity documents. Unlimited excluded complete medical records, medical images and payment-card or bank-account information. HIPAA Journal reported a federal total of 3,803,750; Indiana’s October register lists 3,836,316, without explaining the difference. Unlimited’s filing dates notifications to about 21 July 2026, while Almeida’s report says about 1 July. The company strengthened security, offered two years of identity monitoring and said it knew of no attempted or actual misuse. Related lawsuits were consolidated on 27 August. As of 3 November, the reviewed sources do not establish recovery of the copied data, a settlement or a final litigation outcome. There is no patient software update to install.
- What
- Breach
- Affects
- Unlimited Technology Systems healthcare billing and practice-management services
- Fixed in
- Nothing to patch
- Since
- 1 July 2026
- Closed
- 27 Aug 2026
Timeline
- Update
The court consolidated ten related cases as In re Unlimited Technology Systems Data Breach Litigation and appointed interim counsel. Justia’s available docket ends with this order.
- Update
HIPAA Journal reported that the federal health-data breach register listed 3,803,750 affected individuals, establishing the scale of the breach.
- Update
Unlimited confirmed to Becker’s that ransomware encrypted systems hosting its g4-Centricity for Vector platform, prompting it to suspend access. The company said it had notified affected customers and had no evidence of data misuse.
- Update
Glenn Watts filed a complaint against Unlimited in the US District Court for the Southern District of Ohio.
- Made public
Unlimited’s Iowa filing says patient notifications began around this date and were being mailed in batches. It offered notified individuals 24 months of free identity monitoring and said approximately 162,478 Iowa residents would receive notices.
- Update
Unlimited discovered unauthorised activity, hired forensic investigators and notified law enforcement.
- UpdateNothing to patch
An attacker copied personal information from Unlimited Technology Systems’ commercial data centre between 5 and 10 October, according to the company’s subsequent investigation.
Sources
- Unlimited Technology Systems notification to the Iowa Attorney General and sample patient noticeUnlimited Technology Systems · 21 July 2026
- Notice of Data Breach — sample individual noticeUnlimited Technology Systems
- Unlimited Technology Systems Data Breach Affects 3.8 Million PatientsHIPAA Journal · 6 Aug 2026
- Ransomware attack at health IT vendor exposes 442,000 patients’ dataBecker’s Hospital Review · 29 July 2026
- Unlimited Technology Systems, LLC Data Breach InvestigationAlmeida Law Group · 21 July 2026
- In re Unlimited Technology Systems Data Breach Litigation — docket retrieved 27 August 2026Justia · 27 Aug 2026
- October 2026 year-to-date data breach reportIndiana Attorney General
- 2026 Security Breach NotificationsIowa Attorney General