Apex Spine & Neurosurgery 2025 Data Breach (2.5 Thousand People Affected)

The 2025 Apex Spine & Neurosurgery data breach involved unauthorized access to files on the organization's computer network and the copying of data. According to the official notice, an unknown actor copied files from the network on December 9, 2025.

The U.S. Department of Health and Human Services Office for Civil Rights recorded the event as a hacking/information-technology incident involving a network server and reported 2,500 affected individuals.

Verified Incident Timeline

Apex Spine & Neurosurgery learned on December 23, 2025, that an actor had accessed part of its network and installed a computer virus that locked files. The investigation determined that files had been copied on December 9. The organization updated its public notice on February 5, 2026, and the HHS record is dated February 6, 2026.

What Information May Have Been Affected?

The information may vary by person. The notice lists names, addresses, telephone numbers, dates of birth, Social Security numbers, driver's-license or passport numbers, other government identifiers, locations and dates of health services, treatment, condition, diagnosis, prescription and medical-history information, assigned physicians, financial-account numbers without a security code or access password, health-insurance identifiers, and patient-account numbers. The electronic health-record platform was maintained in a separate network environment and was not affected.

How the Organization Responded

The organization says it securely recovered the network and began an incident investigation and file review. The file review was still underway when the public notice was issued, and direct notices were to be mailed after the review identified the affected people. The organization is also evaluating technical measures and its cyber-auditing practices.

What Should Affected People Do?

Notice recipients should review financial-account activity, credit reports, health-insurance claims, and explanation-of-benefits statements for an unfamiliar transaction or service. People whose Social Security or government-identification information was affected may consider a free fraud alert or credit freeze based on their circumstances.