Medical Express Ambulance Service Data Breach Affects 118K Individuals
Medical Express Ambulance Service has announced a March 2024 data breach that has affected more than 118,000 individuals. Data breaches have also been announced by Vitenas Cosmetic Surgery, Newport Harbor Pathology Medical Group, Rhea Medical Center, and Alabama Ophthalmology Associates.
Medical Express Ambulance Service
Medical Express Ambulance Service in Skokie, Illinois, has recently issued notification letters to individuals affected by a cybersecurity incident that was detected more than a year ago. While not specifically mentioned, the language used indicates this was a ransomware attack. The security breach was identified on March 18, 2024, when network disruption was experienced that affected the functionality of certain systems. Third party cybersecurity experts were engaged to investigate and confirmed that the threat actor had access to systems where patient data was stored and could therefore have acquired patient information.
Legal counsel for Medical Express confirmed that the data mining process was completed on January 30, 2025, and a mailing vendor was engaged on March 3, 2025. The final list for notifications was obtained on March 19, 2025, and the notification letters were mailed on April 14, 2025. The data potentially obtained by the threat actor included names, demographic information, dates of birth, Social Security numbers, driver’s license numbers, medical information, financial information, health insurance information, usernames and passwords, and for some individuals, passport numbers. Medical Express said it is unaware of any misuse of the affected information, but as a precaution, the affected individuals have been offered 12 months of credit monitoring and identity theft protection services. The breach was recently reported to the Maine Attorney General as affecting 118,418 individuals, including 49 Maine residents.
Vitenas Cosmetic Surgery
Vitenas Cosmetic Surgery in Houston, Texas, has notified 31,852 patients that some of their protected health information has been exposed in a recent hacking incident. An attempt by an unauthorized actor to infiltrate its network was detected on or around February 26, 2025. Independent IT security experts were engaged to investigate the security breach and confirmed that some patient data had been exposed and could potentially have been acquired.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The file review concluded on March 28, 2025, when it was determined that the impacted information included names, birth dates, Social Security numbers, driver’s license numbers, and health information. No misuse of that information was detected by the time the notification letters were mailed on April 8, 2025. As a precaution, the affected individuals have been offered complimentary single-bureau credit monitoring, credit report, and credit score services. Vitenas Cosmetic Surgery has been working with cybersecurity experts to enhance its internal security architecture to better protect against incidents in the future.
Newport Harbor Pathology Medical Group
Newport Harbor Pathology Medical Group, which includes Orange County Medical Group Pathology, Mission Laguna Pathology Medical Group, and Barr Dermatopathology, has recently notified the California Attorney General about a security incident detected on November 11, 2024.
Unauthorized activity was identified in part of its network and third-party cybersecurity experts were engaged to investigate the activity. Their investigation confirmed that a threat actor had access to its network from October 8, 2024, to November 11, 2024, and potentially viewed or copied files containing patient data. A comprehensive review of all files on the network confirmed that the exposed information included names, Social Security numbers, dates of birth, addresses, diagnoses, pathology test results, medical record numbers, driver’s license numbers, unique or other government-issued identification numbers, and health insurance information.
Steps are being taken to improve security to prevent similar incidents in the future and the affected individuals have been offered complimentary credit monitoring and identity restoration services for 12 months. The breach is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.
Rhea Medical Center
Rhea Medical Center in Dayton, Tennessee, has announced that it was one of the healthcare providers affected by a data breach at the debt recovery firm Nationwide Recovery Service. The debt collection agency identified suspicious activity within its network in July 2024, which caused a network outage. The investigation confirmed that a threat actor had access to its network from July 5, 2024, to July 11, 2024, and copied files and folders from its systems.
The information stolen in the incident included names, addresses, Social Security numbers, financial information and medical information. Rhea Medical Center’s investigation is ongoing, but it has been confirmed that up to 8,309 individuals have been affected. The HIPAA Journal previously reported on another affected client, Hamilton County in Tennessee. The information of 14,081 individuals was stolen in the attack.
Alabama Ophthalmology Associates
Alabama Ophthalmology Associates, which has offices in Birmingham, Huntsville, and Montgomery in Alabama, has recently started notifying patients about a security incident detected on January 30, 2025. A digital forensics firm was engaged to investigate suspicious network activity, and it was confirmed that a threat actor had access to its network from January 22 to January 30, 2025. A review was conducted to determine the types of data exposed in the incident. That process was completed on March 19, 2025, when it was confirmed that the exposed data included names, dates of birth, Social Security numbers, medical record numbers, treatment information, medical history information, and health insurance information. Notification letters were mailed to the affected individuals on April 7, 2025.
The breach was reported to the HHS’ Office for Civil Rights on April 8, 2025, as affecting 131,576 individuals. The BianLian cyber threat group has claimed responsibility for the attack.
