Survival Flight 2025 Data Breach

The primary source is the Notice of Data Security Incident published on Survival Flight's official domain. Dated August 12, 2025, it says the organization discovered an event affecting its information technology systems on July 17, engaged outside cybersecurity specialists, and identified likely exposure of certain patient information during its investigation.

The second source is the HHS Office for Civil Rights breach portal. Its federal row, dated September 15, 2025, confirms 97,217 people, a Hacking/IT Incident, and Network Server as the location. The organization, year, system type, and health-data categories align across the two channels, and no existing database entry matched the same event.

Survival Flight identified a cybersecurity incident affecting its information technology systems on July 17. It immediately engaged third-party experts to assess, contain, and remediate the event and also notified law enforcement. The incident date is based on the earliest technical activity that can be verified from public sources.

The official notice does not provide the start or end of actor access, the technique used, or a named threat actor. The entry therefore does not construct an estimated intrusion window before discovery and does not label the event as ransomware. The confirmed findings are impact to the systems and likely exposure of patient information.

The investigation identified names, addresses, medical treatment information, and health insurance information as likely exposed for certain patients. Unverified person counts, data fields, and threat-actor claims are not treated as part of the public incident scope. It does not assume that every field appeared for all 97,217 people.

The notice does not identify Social Security numbers, dates of birth, payment cards, financial accounts, passwords, email addresses, or driver's-license information. The document also does not confirm that files were publicly released, sold, or downloaded by a named actor.

The affected-person or record count published by the official source represents the reported scope of the incident. It does not mean that every disclosed data category applied to every person. The company's August notice said work to determine the full extent was ongoing; the September federal record supplies the later notification population. The entry relies on that regulatory total instead of estimating a number from the earlier uncertainty.

The value counts affected individuals, not files, medical flights, insurance claims, or data elements. One patient may have both treatment and insurance information, while another may have a narrower combination.

Survival Flight immediately engaged third-party cybersecurity experts for assessment, containment, and remediation and notified law enforcement. The organization said it took steps intended to reduce the likelihood of a similar event, but its public notice does not disclose the technical details of those controls.

As of the August notice, the investigation had identified no fraud or identity theft resulting from the incident. The company said it would notify affected people and provide protective resources after completing its review. A lack of known misuse does not guarantee that health and insurance information cannot later be used in medical-identity fraud.

Notice recipients should regularly review health-insurance explanations of benefits, annual service histories, and provider records for unfamiliar flights, treatments, doctors, or claims. If an unknown service appears, contact the insurer and healthcare organization through previously known official channels.

Links in unexpected payment, policy-verification, or record-update messages using the name of Survival Flight or an insurer should not be opened directly. Start contact through the organization's official website and the number printed on the insurance card. If a suspicious message or account event appears, it should be verified through the organization’s current official contact channel without using links in the message.