Persante Health Care 2025 Data Breach

The primary document is Persante's “Data Security Incident” notice dated November 26, 2025. The archived PDF describes the January 23–28 access window, January 28 discovery, October 3 scope determination, possible access or acquisition of files, extensive data categories, FBI notification, consumer mailings, and the 844-354-1778 assistance line.

The second source is the official HHS/OCR row dated November 26 for 111,815 people. A public breach source's incident page independently connects the same notice, HHS total, and state disclosures.

When Persante detected unusual network activity around January 28, it secured the network and began an investigation with external cybersecurity experts. The investigation uncovered information suggesting that an unknown actor had unauthorized access from January 23 through January 28 and may have accessed or acquired certain files.

The organization then comprehensively reviewed the potentially affected data and determined around October 3 that certain individuals' personal or protected health information may have been involved. It coordinated notification work with affected medical facilities, verified information and addresses, and mailed letters November 26 to people for whom an identifiable address was available.

The official notice lists names, dates of birth, Social security numbers, driver's license numbers, state identification numbers, passport numbers, other government identification numbers, and Individual taxpayer identification numbers. It also lists dates of medical service, physician or facility information, medical condition or treatment, diagnosis, Medicare or Medicaid numbers, and individual health-insurance policy numbers.

Financial-account numbers, payment-card numbers, patient-account numbers, medical-record numbers, medical-device identifiers, and biometric identifiers also appear in the official list. Scope varies by individual; it should not be assumed that every field was present for every person or that the actor acquired every file.

111,815 is the affected-person count published for this event in the HHS/OCR portal. An attacker-listed row volume is not substituted for this official total.

Local resident counts in state disclosures are subsets of the nationwide total and are not added to 111,815. Likewise, the medical facilities served by Persante may be separate organizations, but Persante's HHS row is retained as one regulatory incident total. This prevents the same people or the same event from being counted twice.

SSNs, passports, tax identifiers, and government identification can increase impersonation and fraudulent-account risks. Medical and insurance fields may be used in false service or claim attempts, while financial-account and payment-card information may support payment fraud. Biometric identifiers can warrant especially careful, long-term monitoring because they cannot be changed like a password.

Recipients should review Explanation of Benefits documents in addition to credit reports, financial accounts, and card activity. An unexpected message claiming to represent Persante or a medical facility should not receive a full SSN, identification number, payment information, password, or one-time code. An unfamiliar medical service or financial transaction should be verified directly with the relevant institution.

Persante said it secured the network, performed a scope review with external experts, notified the FBI, and took additional steps intended to prevent a similar event. Notifications were coordinated with medical facilities, and people were mailed information about the incident and protective measures. The organization does not make a blanket statement that misuse definitely occurred.

The call center at 844-354-1778 is available weekdays from 9:00 a.m. to 6:30 p.m. Eastern Time. A person should treat their own notification letter as the primary source for their individual data scope and report suspicious activity to the relevant financial institution, healthcare provider, or law-enforcement agency. A fraud alert or free credit freeze may also be considered when appropriate.