ApolloMD Confirms 626,500 Patients Affected by May 2025 Ransomware Attack
The extent of a May 2025 ransomware attack on the Georgia-based physician- and clinician-owned staffing and management group ApolloMD has recently been confirmed. The ransomware attack was detected on May 22, 2025; however, it has taken months for the investigation and data review to be completed. ApolloMD announced the attack in September 2025, when it started sending notification letters to the affected individuals’ physician practices, and on February 2, 2026, almost 9 months after the ransomware attack occurred, the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) was informed that the incident involved unauthorized access to the electronic protected health information of 626,540 individuals.
With more than 626,000 individuals affected, it was one of the most impactful healthcare ransomware attacks of the year, ranking above Covenant Health’s Qilin ransomware attack, which affected 478,188 patients. While severe, these attacks are small in comparison to the ransomware attack on Conduent Business Services, which is known to have affected more than 25 million individuals.
The healthcare sector has long been a favored target of ransomware groups, but never more so than in 2025, when record numbers of attacks were reported. In 2025, the healthcare sector recorded more attacks than any other industry sector, accounting for 22% of all disclosed ransomware attacks in 2025.
September 24, 2025: Business Associate ApolloMD Confirms Breach Affecting Eleven Physician Practices
ApolloMD Business Services, LLC (ApolloMD), an Atlanta, GA-based provider of integrated, multispecialty physician, APC, and practice management services, has recently disclosed a security incident affecting several of its physician practice clients.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Unusual activity was identified within the ApolloMD network environment on May 22, 2025. An investigation was launched to determine the nature and scope of the activity, and steps were taken to secure its network. Assisted by a third-party cybersecurity firm, ApolloMD learned that an unauthorized third party had access to its network from May 22, 2025, to May 23, 2025. During that time, files containing the electronic protected health information (ePHI) of ApolloMD’s affiliated physicians and practices may have been accessed or acquired.
The file review determined that the information potentially stolen in the incident included names, addresses, dates of birth, diagnoses, provider names, dates of service, treatment information, and health insurance information. A subset of individuals also had their Social Security numbers exposed. ApolloMD notified the affected physicians and practices between July 21, 2025, and September 11, 2025, and notification letters started to be mailed to the affected individuals on September 17, 2025. ApolloMD has confirmed that complimentary credit monitoring and identity theft protection services are being offered to individuals whose Social Security numbers were exposed.
ApolloMD did not disclose details about the nature of the attack; however, the Qilin ransomware group claimed responsibility and added ApolloMD to its dark web data leak site in June 2025. Qilin claimed to have exfiltrated a large amount of sensitive data and said it would release the data on June 16, 2025, if the ransom was not paid. At the time of writing, the Qilin data leak site is not accessible, and other sites operated by the group are protected by a login. Qilin has been the most active ransomware group in four of the five months up to August 2025, according to cybersecurity firm Cyble, having claimed more than twice the number of victims as the second most active group. It should be stated that ransomware groups have been known to fabricate claims on their data leak sites.
The total number of affected individuals has not been made public by ApolloMD at this stage, and the data breach is not currently shown on the HHS’ Office for Civil Rights website.
ApolloMD is issuing notification letters on behalf of the following covered entity clients.
- Passaic Hospitalist Services, LLC
- Passaic River Physicians, LLC
- Pensacola Hospitalist Physicians, LLC
- Broad River Physicians Group, LLC
- Olive Branch Emergency Physicians, LLC
- Aurora Emergency Physicians, LLC
- The Bortolazzo Group, LLC
- Methodist University Emergency Physicians, PLLC
- Trinity Emergency Physicians, LLC
- Lorain Emergency Physicians, LLC
- Pennsylvania Hospitalist Group, LLC
