An unauthorised third party had accessed systems that contained personal information, according to Apria's inquiry. Because of the way they said it, it's unclear whether there were two separate occurrences involving various evil guys or organisations, or if the same bad guy was probably responsible for both. Based on its investigation and communications with law enforcement, Apria is confident that the unauthorised access was made with the intent to steal money from the company, not to gain access to patient or staff personal information. There is no proof that any money was taken, and Apria is not aware that any personal data relating to this incident was misused.