Unlimited Technology Systems Breach Exposed Data of 3.8 Million Healthcare Patients
Summary
Unlimited Technology Systems reported unauthorized access to its data center in October 2025, affecting 3,803,750 people. Exposed information included personal and health data; the access method and actor are unknown.
Key points
- The company discovered unauthorized activity on October 19, 2025; investigators determined access occurred between October 5 and October 10.
- The reported breach affected 3,803,750 people connected to more than 4,500 clinics and 6,500 specialty healthcare providers.
- Potentially exposed information included contact details, Social Security numbers, insurance and patient-balance data, diagnoses, and scanned identity documents.
- The article says full medical records, medical images, and payment-card or bank-account information were not involved.
- The initial access method has not been disclosed, and no threat actor has claimed responsibility; the article reports no evidence of ransomware or extortion.
- Notifications began July 1, 2026, and affected individuals were offered 24 months of credit monitoring and identity protection.
Article Details
- Victim Organization
- Unlimited Technology Systems
- Incident Type
- Unauthorized access to a commercial data center with potential exfiltration of patient data
- Incident Date
- 2025-10-05
- Disclosure Date
- 2026-07-01
- Data Types Exposed
- Names
- Addresses
- Email addresses
- Phone numbers
- Dates of birth
- Social Security numbers
- Health insurance information
- Patient balance information
- Medical information, including diagnoses
- Scanned driver’s licenses and other government IDs
- Insurance cards
- Intake forms
- Health insurance policy numbers
- Claims and benefits information
- Medical record numbers
- Dates of service
- Affected Records
- 3,803,750 individuals
- Operational Impact
- Unauthorized access to the company’s commercial data center and exposure of patient data affecting individuals associated with over 4,500 clinics and 6,500 specialty healthcare providers. No full medical records, medical images, or payment card or bank account information were involved. The company implemented enhanced security measures.
- Ransom Or Extortion
- No evidence of ransomware, data encryption, or extortion attempts; no threat actor or group claimed responsibility.
- Claim Status
- confirmed