A billing and revenue cycle vendor for oncology and specialty practices says intruders reached one of its commercial data centers last October and stole files tied to over 3.8 million people. Unlimited Technology Systems, based in Montgomery, Ohio, supports more than 4,500 oncology practices and over 6,500 specialty providers.
The exposed data could span names, health insurance identifiers, clinical information such as record numbers, diagnoses and service dates, scans of driver’s licenses and insurance cards, Social Security numbers, and contact details including birth date, address, email, and phone. Full medical charts, imaging files, and card or bank account numbers were not part of the breach, the company said.
The company discovered the unauthorized activity on October 19, hired a forensic firm, and notified law enforcement. It reported 3,803,750 affected individuals to the U.S. Department of Health and Human Services. No threat actor has been named, and no extortion group has claimed responsibility.
Those affected get two years of free Kroll identity protection with credit monitoring and fraud restoration. Given that Social Security numbers and insurance details were among the stolen fields, anyone notified should be alert for signs of misuse.
