BAYADA Data Breach Exposes Sensitive Health and Personal Information BAYADA, a healthcare provider, recently disclosed a data breach involving sensitive personal and health information after its third-party vendor, Doctor Alliance, suffered a cybersecurity incident. The breach was first reported to BAYADA on December 4, 2025, prompting an investigation into the scope of the exposure. Doctor Alliance confirmed that unauthorized access to its systems occurred during two separate periods: October 31–November 6, 2025, and November 14–17, 2025. The compromised data may include: - Full names - Social Security numbers - Dates of birth - Medical diagnoses and treatment details - Provider and health insurance information - Prescription records - Hospital admission/discharge data - Disability information BAYADA posted a breach notice on its website and began mailing notifications to affected individuals on January 30, 2026. Impacted parties are being offered 12 months of complimentary credit monitoring and a detailed list of the exposed data specific to their records. The incident underscores the risks of third-party vendor vulnerabilities in healthcare data security.

On November 7, 2025, Doctor Alliance, a Dallas-based healthcare technology provider, suffered a ransomware attack by a hacker known as 'Kazu.' The attacker infiltrated the company’s systems, exfiltrating over 1.2 million files (353 GB), including personally identifiable information (PII) such as names, addresses, Social Security numbers, dates of birth, and protected health information (PHI) like medical records, treatment details, and health insurance data. The breach poses severe risks of identity theft, medical fraud, and privacy violations for affected individuals nationwide, given Doctor Alliance’s integration with electronic health record (EHR) systems and its role in processing high volumes of clinical and administrative data. The hacker demanded a ransom, threatening to release the stolen data. As of now, Doctor Alliance has not issued a public statement, leaving patients and partners uncertain about mitigation steps. The incident underscores critical vulnerabilities in healthcare data security, with potential long-term reputational, financial, and operational consequences for the company and its stakeholders.