Medusind
Disclosed Jan 7, 20251 year ago701,475 affectedSettled
Medical billing firm Medusind discloses breach of patient data
Medusind detected suspicious activity in December 2023 and in January 2025 notified people that files with health, insurance, payment and government ID data had been copied. It first reported 360,934 affected to Maine; the HHS total later rose to 701,475, and it settled class claims for $5 million.
What is known
| People affected | 701,475 (as reported to HHS) |
|---|---|
| Disclosed | Jan 7, 2025 |
| Discovered | Dec 29, 2023 |
| Happened | Dec 29, 2023 |
| Attack | Hacking |
| Data exposed | Names, Government IDs, Health, Insurance, Credentials and tokens, Biometrics, Social Security numbers, Financial, Payment cards |
| Sector | Healthcare · US |
| Status | Settled |
| Lawsuit or fine | $5M class action settlement |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Medusindoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Medusindatg.wa.gov · Official notice | Official notice |
| Notice letter filed with the Delaware DOJ: Medusindattorneygeneral.delaware.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Medusindjustice.oregon.gov · Official notice | Official notice |
| HHS OCR breach report: Medusind (Business Associate, FL)ocrportal.hhs.gov · Official notice | Official notice |
| Medical billing firm Medusind discloses breach affecting 360,000 peoplebleepingcomputer.com · News | News |
| January 2025 Healthcare Data Breach Reporthipaajournal.com · News | News |
| Largest Healthcare Data Breaches of 2025hipaajournal.com · News | News |
| Indiana Attorney General 2025 data breach report: Medusindin.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Jan 7, 2025 | |
| Delaware DOJresidents of DE | Jan 7, 2025 | 317 |
| Oregon DOJresidents of OR | Jan 7, 2025 | 360,934 |
| HHS OCRtotal | Jan 7, 2025 | 701,475 |
| Researchtotal | Jan 7, 2025 | 701,475 |
| Indiana AGresidents of IN | Jan 7, 2025 | 2,241 |
| California AGresidents of CA | Feb 11, 2025 | |
| Washington AGresidents of WA | Feb 11, 2025 | 511 |
| Oregon DOJresidents of OR | Feb 11, 2025 | 691,192 |
History of this record
- 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-2025.pdf · backfill source
- 2026-09-25 · status: confirmed to settled · seed source
- 2026-09-25 · lawsuit: empty to $5M class action settlement · seed source
- 2026-09-25 · attack: ransomware to hacking · seed source
- 2026-09-25 · data_types: ["names","government-id","health","insurance","credentials","biometrics"] to ["names","government-id","health","insurance","credentials","biometrics","ssn","financial","payment-card"] · seed source
- 2026-09-25 · summary: empty to Medusind detected suspicious activity in December 2023 and in January 2025 notified people that files with health, insurance, payment and government ID data had been copied. It first reported 360,934 affected to Maine; the HHS total later r · seed source
- 2026-09-25 · title: empty to Medical billing firm Medusind discloses breach of patient data · seed source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 701475 · backfill source
- 2026-09-25 · data_types: [] to ["names","government-id","health","insurance","credentials","biometrics"] · backfill source
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to ransomware · backfill source
- 2026-09-25 · discovered: empty to 2023-12-29 · backfill source
- 2026-09-25 · disclosed: 2025-02-11 to 2025-01-07 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.