Hematology Oncology Consultants Reports Breach Exposing Personal and Medical Information
Summary
Hematology Oncology Consultants said a 2025 ransomware attack compromised files containing personal and medical information, including Social Security numbers. Rhysida claimed the attack; the practice notified affected people in April 2026.
Key points
- The practice said its network was targeted on or about September 20, 2025. Rhysida claimed responsibility and later claimed it obtained the organization's data.
- The company said it learned on or about February 12, 2026, that files containing personally identifiable information had been compromised by an unauthorized actor.
- Reportedly exposed information included names, medical records, health insurance information, and Social Security numbers; the article also lists dates of birth, addresses, government IDs, and financial information.
- The company completed its review on April 7, 2026, and dated notification letters to affected individuals April 24.
- The practice said it secured its digital environment and investigated with cybersecurity specialists; it also established a call center and provided guidance for affected individuals.
Article Details
- Victim Organization
- Hematology Oncology Consultants
- Incident Type
- Ransomware attack on the organization's computer network; files containing personally identifiable information were compromised by an unauthorized actor.
- Incident Date
- 2025-09-20
- Disclosure Date
- 2026-04-24
- Data Types Exposed
- Names
- Medical records
- Health insurance information
- Social Security numbers
- Dates of Birth
- Addresses
- Government IDs
- Medical Info
- Financial Info
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- The company secured its digital environment and investigated the incident with cybersecurity specialists. No operational disruption was reported.
- Ransom Or Extortion
- Rhysida claimed responsibility and, in a dark-web post on 2025-10-17, claimed to have obtained data from the organization. The article does not report a ransom demand or confirm that the group's data-acquisition claim was verified.
- Claim Status
- confirmed