The Heart South Cardiovascular Group data breach affected 46,666 people in an incident that emerged in November 2025 and involved identity and health information.
Heart South provides cardiology and vascular care in Alabama. This record covers the November 2025 incident, which is separate from the organization's previously reported May 2024 event.
What Happened in the Heart South Breach?Heart South learned on November 11, 2025 that an unauthorized party claimed to possess company data. Its forensic investigation found no technical evidence of unauthorized network access or data theft, but a limited amount of Heart South data was found posted on the dark web.
The company determined on February 12, 2026 that patient information was stored in the affected system locations and began notices on or about April 6, 2026. Public documents do not explain how the data was obtained or identify the person who posted it.
What Information Was Affected?The official New Hampshire notice lists full names together with one or more of the following: Social Security numbers, dates of birth, treatments, procedures, diagnoses, medications, or health insurance information.
Heart South says it could not confirm which information was affected for a specific person, so every field should not be assumed to apply to everyone. The company reported no evidence of related identity theft or financial fraud as of the notice date.
How Many People Were Affected?The official U.S. Department of Health and Human Services breach portal reports 46,666 affected individuals. The two people listed in the New Hampshire notice are a state subset of the nationwide total and are not added separately.
What Should Affected People Do?Notice recipients should rely on the data scope in their own letters and review benefit statements, prescriptions, insurance claims, and medical records for unfamiliar transactions or providers.
People whose Social Security numbers were involved can monitor credit reports and consider a free credit freeze or fraud alert. Unexpected requests using the name of Heart South, an insurer, or a healthcare provider should be verified through an independent channel.