IPPC 2025 Data Breach
The 2025 IPPC data breach concerns a network incident affecting pharmacy services provided to long-term-care organizations by IPPC Inc., IPPC of New York LLC, and Innovative Pharmacy LLC. According to the official notice filed with the Vermont Attorney General, an unknown actor accessed the technical network from 18 to 19 September 2025; files were copied and may have been viewed during that period.
Exposed Data Types
2 sensitive4- Medical information
- Health insurance information
- Names
- Social security numbers
About This Breach
IPPC completed its file review around 9 February 2026 and began HIPAA notifications on 27 February.
The official Vermont summary says the affected files included names, Social Security numbers, medical information, and health-insurance information. The combination may vary by person; the notice does not say that every field was accessed for every person or that the information was misused. IPPC said it was not aware of incident-related identity theft or fraud when it issued the notice. Dates of birth, driver's-license and passport details, payment cards, bank accounts, and other items in the old structured list were removed because the official state summary does not establish them.
What does 133,862 people mean?
The live U.S. Department of Health and Human Services breach listing reports 133,862 people for IPPC and identifies the location as a network server. This is an external regulatory person count, not a locally imported record total or a searchable person profile. Production has no import job or locally linked email, identity, health, or financial dataset for this breach, so totalRecords is not presented as a local total and the import count is zero.
Practical next steps
People who received a direct notice should use the data types listed in their letter and verify the sender through a known IPPC contact channel. If a Social Security number was listed, a credit freeze or fraud alert may be appropriate; if medical or insurance information was listed, review explanations of benefits and unfamiliar claims. The catalog count alone does not prove that a particular person's record was involved.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
