Excelas 2025 Data Breach
The Excelas 2025 data breach concerns unauthorized access to certain computer systems used by Ocelot Ventures, LLC under the Excelas name.
Exposed Data Types
5 sensitive11- Medical information
- Health information
- Diagnosis information
- Medication information
- Medical record images
- Full names
- Dates of birth
- Social security numbers
- Government-issued identification
- Insurance information
- Payment information
About This Breach
According to Excelas's official notice, suspicious activity was identified on or about 28 January 2026. The investigation found that an unauthorized person accessed certain systems between 27 November and 3 December 2025 and may have accessed or taken a limited amount of information.
The Indiana Attorney General's official report lists 2,309 affected people, including 28 Indiana residents. HHS/OCR separately lists 2,275 people for the same event. Because the sources do not explain the 34-person difference, the figures are not combined and the HHS value is not labeled a subset without evidence; the 2,309 figure expressly identified as the overall total is used.
What information may have been involved?
Excelas's notice lists names, dates of birth, Social security numbers, and government-issued identification, with the combination varying by person. Medical, health, or diagnosis information, medication information, medical-record images, insurance information, and payment information may also have been involved. The notice says a limited amount of information may have been accessed or taken; it does not establish that every category applied to all 2,309 people or that every listed field was definitely taken.
Organization response and safe next steps
Excelas said it investigated with external cybersecurity specialists, contacted law enforcement, and worked to enhance system safeguards. At the time of the official notice, there was no evidence that personal information had been used for identity theft or fraud. Notice recipients should rely on their individual letter for their data scope and review credit, payment, and health insurance records for unfamiliar accounts, transactions, prescriptions, or services. Unexpected messages claiming to represent Excelas should be verified through a current official channel without using links in the message.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
