EPIC Health 2026 Data Breach (58 Thousand People Affected)

The 2026 EPIC Health data breach was a security incident in which an unauthorized actor accessed certain computer systems belonging to Exclusive Physicians PLLC and acquired files. The organization says the incident may have involved certain patient information.

The U.S. Department of Health and Human Services Office for Civil Rights recorded the event as a hacking/information-technology incident involving a network server and reported 58,000 affected individuals.

Verified Incident Timeline

According to the official notice, the unauthorized actor accessed certain systems and acquired files on or around January 3, 2026. EPIC Health identified suspicious network activity on January 7, secured its systems, and began investigating with cybersecurity professionals and federal law enforcement.

What Information May Have Been Affected?

The scope may vary by person. The notice lists names, dates of birth, ages, marital status, home addresses, home and cell phone numbers, email addresses, patient IDs, insurance payor names, and diagnosis categories. The organization says its electronic medical record system was not accessed and that Social Security numbers and financial account information were not involved.

How the Organization Responded

EPIC Health says it enhanced its security measures and implemented additional safeguards after the incident. The organization also says it obtained assurances from the unauthorized party that the acquired information was deleted and not further used or disclosed.

What Should Affected People Do?

Notice recipients should review health-insurance statements and patient accounts for services they do not recognize. They should be cautious of convincing emails, text messages, or calls that use contact or diagnosis information and should sign in only through the organization's known official address.