Unlimited Technology Systems 2025 Data Breach

The primary evidence is Unlimited Technology Systems' consumer letter published in an Iowa Attorney General filing. On the company's behalf, it directly explains discovery, the October 5–10 copy-acquisition period, law-enforcement and forensic response, confirmed information categories, data expressly excluded, two years of Kroll services, and the assistance line.

A California Attorney General record provides a separate official notification trail. Texas Attorney General record BR-0005193 reports 3,836,316 affected people nationwide, including 277,364 Texas residents. The 148,342 people reported in South Carolina and 2,223 in Massachusetts are state subsets of that nationwide total.

Unlimited discovered unauthorized activity in its commercial data center October 19. The company retained a leading cybersecurity forensics firm, notified law enforcement, and reviewed the data involved. The investigation concluded that an unauthorized actor may have obtained a copy of some personal information from October 5 through October 10.

The public letter does not identify the initial access vector, actor, malware, ransom demand, or publication of data. “May have obtained a copy” confirms potential extraction but does not establish that every field was copied for every person. Because Unlimited processes information for healthcare providers, some individuals may be affected even if they have no direct relationship with the company.

Depending on the individual, data could include names, Social security numbers, dates of birth, email addresses, physical addresses, telephone numbers, and other demographic information. Scanned documents could include driver's licenses or other government IDs, insurance cards, and patient-intake forms. It should not be assumed that every individual had all fields present; personal letters define the specific scope.

A combination of SSN, birth date, contact data, and identity images creates lasting exposure to fraudulent credit, tax-identity misuse, document impersonation, and targeted social engineering. Recipients should consider a credit freeze, fraud alert, and IRS Identity Protection PIN and should not provide identity images, passwords, or verification codes in messages claiming to come from a healthcare provider or Unlimited.

Health-insurance and patient-balance information could include insurance-policy numbers, claims or benefits information, and patient balances. Medical information included medical-record numbers, dates of service, and diagnoses. Insurance cards and intake forms were also listed among scanned documents. These fields can enable medical-identity misuse, fraudulent claims, or scams using authentic care context.

Individuals should review explanation-of-benefits statements, patient portals, and provider accounts for services, diagnoses, claims, balances, or contact changes they do not recognize. Suspicious entries should be verified directly with the provider and insurer. Because Unlimited serves multiple healthcare customers, a recipient who does not recognize the vendor should verify the provider relationship identified in the notice through an official channel.

The official consumer letter expressly says the incident data did not include full patient medical records or medical imaging. It also excludes financial information such as credit-card and bank-account information. Patient-balance information does not conflict with this exclusion: a debt or balance context may be present while card and bank-account details are absent.

General guidance to monitor bank and card statements does not prove that those fields were exposed. Incorrectly adding source-excluded data would distort both user risk assessment and search-result accuracy.

Texas Attorney General record BR-0005193 publishes an exact nationwide total of 3,836,316 affected people, including 277,364 Texas residents. The 148,342 people in South Carolina and 2,223 in Massachusetts are subsets and have not been added on top of the nationwide figure.

Unlimited enhanced security, investigated with forensic specialists, notified law enforcement, and offered eligible people two years of Kroll identity monitoring. The package includes single-bureau credit monitoring, fraud consultation, and identity-theft restoration. Questions may be directed to 844-576-3063 weekdays from 9 a.m. to 6:30 p.m. ET.