Unlimited Technology Systems breach affects 3.8 million people
Summary
Unlimited Technology Systems reported unauthorized access to files in its data center from Oct. 5–10, 2025; an HHS portal lists 3,803,750 affected people. Potentially exposed records include identifiers and health information.
Key points
- The company detected unauthorized activity on Oct. 19, 2025; its investigation found that an unauthorized actor accessed files from Oct. 5–10.
- A U.S. Department of Health and Human Services breach portal lists 3,803,750 affected people.
- The company said the actor may have obtained copies of patients’ personal information.
- Potentially affected information includes Social Security numbers, dates of birth, government ID scans, insurance details, and medical information.
- Unlimited Technology Systems notified law enforcement and began sending patient notices on July 1, 2026.
- The company has not identified the perpetrators, and no ransomware or extortion group has publicly claimed responsibility.
- Notice recipients were offered identity monitoring services through Kroll.
Article Details
- Victim Organization
- Unlimited Technology Systems
- Incident Type
- Data breach involving unauthorized access to files in a commercial data center
- Incident Date
- 2025-10-05
- Disclosure Date
- 2026-07-01
- Data Types Exposed
- Full names
- Social Security numbers
- Dates of birth
- Email and mailing addresses
- Phone numbers
- Demographic information
- Scans of driver’s licenses and other government IDs
- Insurance cards
- Intake forms
- Health insurance policy numbers
- Claims and benefits information
- Medical record numbers
- Dates of service
- Diagnosis information
- Affected Records
- 3,803,750 people
- Operational Impact
- Unauthorized access to files in the company's commercial data center occurred from October 5 to October 10, 2025. The company said copies of personal information may have been obtained. It notified law enforcement and offered identity monitoring services to affected people.
- Ransom Or Extortion
- No ransomware or data-extortion group had publicly claimed responsibility, and the company had not identified the perpetrators.
- Claim Status
- confirmed