ModMed Data Breach

ModMed detected suspicious activity on its servers on July 21, 2025. Its investigation confirmed that unauthorized access occurred on July 9 and 10 and that files containing sensitive information were copied.

The company's public disclosures do not identify the initial-access method, an exploited software vulnerability, or the responsible actor. The incident is therefore not attributed to an unconfirmed attack technique or threat actor.

The categories varied by person. Disclosed fields may have included names, dates of birth, addresses, phone numbers, email addresses, Social Security numbers, driver's-license numbers, or other government-issued identification numbers.

Medical record and patient account numbers, provider and practice names, billing and diagnostic codes, prescription or medication information, diagnosis and treatment details, and health-insurance information may also have been involved for some people. Bank or financial-account information was also within the disclosed scope. ModMed said full medical records were not involved.

The HHS OCR record reports 198,795 affected individuals for the network-server Hacking/IT Incident. This is the event's affected-person total; it does not mean every listed data category was exposed for every person.

Identity fields such as Social Security numbers, dates of birth, and addresses can increase the risk of identity theft, fraudulent account applications, or tax fraud when combined. Financial-account and government-ID information can also be used in fraud attempts.

Medical, prescription, insurance, and provider details can help an attacker create targeted messages that appear to refer to a real treatment relationship. Accurate-looking health details do not prove that the sender is authorized.

ModMed opened an investigation, reviewed the affected files, and notified relevant healthcare providers on September 19, 2025. Mailing of individual notification letters began on October 17, 2025.

People whose Social Security numbers were involved were offered complimentary credit monitoring and identity-theft protection. The company also said it took additional security steps intended to prevent similar incidents.

Notice recipients can monitor credit reports, bank accounts, health-insurance statements, and medical bills for unfamiliar activity. If a Social Security number was involved, a credit freeze or fraud alert may be appropriate.

For an unexpected message claiming to come from ModMed, a medical practice, or an insurer, use the organization's official contact channel before following a link. Do not share a password, payment detail, or verification code.