Carolina Arthritis Data Breach
The 2024 Carolina Arthritis Associates data breach followed a cyberattack on the healthcare provider's computer network that allowed unauthorized access to certain files.
Exposed Data Types
7 sensitive10- Medical record numbers
- Provider names
- Medical information
- Diagnoses
- Prescription information
- Treatment information
- Health insurance information
- Names
- Dates of birth
- Social security numbers
About This Breach
According to the organization's regulatory notice, the network disruption was detected on September 27, 2024, and the investigation found that some files may have been acquired without authorization that same day.
Carolina Arthritis Associates is a rheumatology practice in Wilmington, North Carolina.
When did the breach occur?
The Maine Attorney General record lists September 27, 2024 as the breach date. The organization completed its review of the affected files on January 21, 2025 and mailed individual notices on February 27.
What information may have been affected?
Depending on the person, the information could include names, dates of birth, Social Security numbers, medical record numbers, provider names, diagnosis or clinical information, medical histories, mental or physical condition information, prescription information, treatment or procedure information, health-insurance information and medical-claim information.
The public notices state that not every data field was involved for every person. Passwords, payment-card data and bank-account information were not listed among the affected data types.
How many people were affected?
The Maine Attorney General breach record reports a total of 36,961 affected people.
What should affected people do?
Notice recipients should review credit reports, health-insurance explanations of benefits and patient accounts for unfamiliar transactions or services. People whose Social Security numbers were involved may wish to consider a credit freeze or fraud alert.
Be cautious with unexpected calls, emails and messages requesting health or identity information, and independently verify requests through contact channels on the practice's official website. If suspicious activity appears, contact the relevant healthcare provider, insurer and credit bureau directly.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
