Columbia Medical Practice 2025 Data Breach

The primary source is the organization's public cybersecurity notice updated November 26, 2025. It describes the November 5 access, virus used to lock files, same-day copying of files, potential data categories, and separation of the unaffected electronic health record system. The notice also provides the 1-833-974-3375 assistance line.

The second source is the official HHS/OCR entry dated December 5 for 94,131 people. An April 24, 2026 consumer letter published by the Massachusetts Attorney General confirms that the file review finished March 31, the individual notification process, and additional technical measures. An attacker-group name in secondary reporting is absent from the official documents and is therefore excluded.

Columbia Medical Practice said an unknown cyber actor accessed part of its network and installed a computer virus that locked files on computer systems. The organization engaged cybersecurity specialists, securely restored the network, and investigated the event. The inquiry determined that the actor copied files from the computer network on that same day.

The organization published its first public notice while the file review was still underway so that it could disclose the event promptly. According to the later consumer letter, the intensive review to identify the people and fields in the copied files was completed March 31, 2026. Direct letters were sent beginning April 24 to individuals for whom address information was available.

Depending on the individual, copied files may have contained a name together with address, phone number, date of birth, Social Security number, driver's license number, passport number, or other government identifier. Health categories include location and dates of services, treatment or condition, diagnosis and diagnosis code, prescription information, medical history, and assigned physician.

Payment and insurance categories include a financial account number without a security code, access code, or password to access the account; a health-insurance subscriber or identification number; and a patient account number. That qualification matters: a financial account number may have been involved, while account-access codes and passwords were not described in the same scope. Not every person had every field.

Columbia Medical Practice specifically said its electronic health records platform at the time was maintained in a logically separated computer-network environment and was not affected. This does not mean copied network files contained no health information; it means the central EHR platform was separate from the affected portion of the network.

Unverified person counts, data fields, and threat-actor claims are not treated as part of the public incident scope. At the same time, it does not minimize the event as merely an attempted access because the public notice confirms that files were copied. The affected-person or record count published by the official source represents the reported scope of the incident. It does not mean that every disclosed data category applied to every person.

A combination of SSN, date of birth, and government identification can raise the risk of impersonation, new-account fraud, tax fraud, or benefits fraud. Diagnosis, prescription, physician, and service-date details may support convincing fake healthcare messages. Insurance and patient account numbers can provide context for fraudulent claims, bills, or payment notices.

Recipients should review credit reports and financial statements as well as Explanation of Benefits documents, prescription history, and unexpected patient-account activity. Use a known institutional channel instead of a link in a message claiming to be from Columbia Medical Practice or a physician, and do not disclose a full SSN, password, access code, payment, or one-time code.

Columbia Medical Practice said it remediated and confirmed the security of its network, reviewed files with cybersecurity specialists, and implemented additional technical measures and processes. It also reviewed cyber-auditing practices, policies, and procedures. The later individual letter says complimentary identity-monitoring services were offered; enrollment details are contained in each recipient's letter.

The public 1-833-974-3375 line is available weekdays from 8:00 a.m. to 8:00 p.m. Eastern for questions. A fraud alert or free credit freeze may be appropriate if unfamiliar credit activity appears, and suspicious healthcare or insurance entries should be verified directly with the provider and insurer. The fields in an individualized letter are more useful than the general list for assessing personal scope.