Woundtech 2025 Data Breach

The primary evidence is Woundtech's Notice of Data Breach, published on its own domain on March 16, 2026. The organization says it detected unusual network activity on December 6, retained a third-party cybersecurity firm, and learned from the forensic investigation on December 31 that certain information may have been copied. This is a company-confirmed event rather than an entry based only on an actor's claim.

The HHS OCR row classifies Wound Technology Network, Inc. as a Healthcare Provider and the event as a Hacking/IT Incident affecting a Network Server. Its total of 139,830 people supplies the regulatory scope not stated in the company notice. The two sources align on the event type, affected environment, and involvement of sensitive health information.

Woundtech noticed unusual network activity on or around December 6, 2025 and promptly opened an investigation. The official notice says the unauthorized activity occurred between December 6 and December 9. The incident date is based on the earliest technical activity that can be verified from public sources.

The forensic investigation concluded on December 31 that certain information may have been copied. Woundtech then conducted a comprehensive review to determine whose information and which data types were present; the work to identify the potential notice population finished on March 2, 2026. The public notice followed on March 16, and letters were mailed where a valid address was available.

Identity and contact fields include first names, last names, dates of birth, telephone numbers, and gender. The clinical categories are clinical notes, medical health information, medical treatment information, medical diagnosis information, and medical treatment images. Health-insurance information is also in scope, while Social Security numbers were involved only in what the organization described as a very limited amount.

The list does not mean that every person had all of those fields. The official notice states that the information differs by individual and directs recipients to their personal letter for the exact categories. Unverified person counts, data fields, and threat-actor claims are not treated as part of the public incident scope.

The affected-person or record count published by the official source represents the reported scope of the incident. It does not mean that every disclosed data category applied to every person. It is the affected-person count reported by Woundtech to the federal regulator, not the number of files, images, or distinct data fields that may have been copied. Separate categories are not added together to produce a new victim total.

A threat actor posted a larger claim involving more than 160,000 patients and multiple terabytes of data. The company notice does not validate that actor-supplied count, and the HHS record provides a different regulatory total.

Woundtech provides chronic-wound management and advanced wound-care services. Clinical notes, diagnoses, treatment information, and treatment images can reveal private context about a person's condition and course of care, not merely identity details. When combined with health-insurance information, the data may increase the risk of false claims, provider impersonation, or targeted fraud.

Files containing Social Security numbers, even for a very limited subset, can create longer-term identity-theft risk. The public notice does not disclose which fields applied to which people in aggregate. Unverified person counts, data fields, and threat-actor claims are not treated as part of the public incident scope.

Woundtech mailed notice letters to people identified in the affected files for whom a valid mailing address was available. It recommended monitoring account statements, health-insurance explanations of benefits, and free credit reports for suspicious activity. Recipients should rely on the individual data scope and official assistance line shown in their notice letter.

An unfamiliar medical service, insurance claim, or payment should be checked with the provider and insurer through a known official channel. Unexpected links, image requests, or identity-verification messages presented in Woundtech's name deserve scrutiny because incident context can support phishing.