Conifer Value-Based Care Reports Email Breach Exposing Pediatric Patient Data On August 28, 2025, Conifer Value-Based Care, LLC—a subsidiary of Conifer Health Solutions providing administrative services to healthcare providers and plans—detected unauthorized access to an employee’s Microsoft Office 365-hosted business email account. The breach, which also occurred on August 29, exposed personally identifiable information (PII) and protected health information (PHI) of pediatric patients, their parents, and guarantors. The compromised data included names, dates of birth, medical details, and health insurance information, though the exact scope varied by individual. Notably, the breach was isolated to the email account and did not affect Conifer’s internal networks or systems. Conifer contained the threat immediately and launched an investigation, concluding on November 10, 2025, with affected providers and health plans notified by November 14. Address verification for impacted individuals was finalized by December 5, and the breach was officially disclosed to the California Attorney General on December 18, 2025. A Notice of Data Breach was also posted on Conifer’s website. In response, the company enhanced security controls and monitoring to prevent future incidents and collaborated with providers to notify affected parties. While no evidence suggests misuse of the exposed data, the breach underscores risks to sensitive healthcare information.

Conifer Revenue Cycle Solutions, LLC (“we” or “Conifer”), a provider of revenue cycle management and other administrative services to healthcare providers, suffered a cybersecurity incident that affected its users' personal information. An unauthorized third party gained access to a Microsoft Office 365-hosted business email account and compromised certain information. The exposed information involved information to identify the individual (such as full name, date of birth, and address); (2) Social Security number, driver’s license/state ID number, and/or financial account information; (3) medical and/or treatment information (such as medical record number, dates of service, provider and facility, diagnosis or symptom information, and prescription/medication); (4) health insurance information (such as payor name and subscriber/Medicare/Medicaid number); and (5) billing and claims information. However, upon revelation, the email account was separate from Conifer’s internal network and systems, and those who were affected were notified.

The Vermont Office of the Attorney General disclosed a data breach affecting Conifer Revenue Cycle Solutions, LLC, discovered on April 14, 2022, but reported on September 30, 2022. The incident involved unauthorized access to a Microsoft Office 365-hosted email account, potentially compromising personal information of individuals. The exposed data included sensitive medical and health insurance details, raising concerns about privacy violations and potential misuse of protected health information (PHI). While the exact number of affected individuals was not specified, the breach highlights vulnerabilities in third-party vendor systems handling healthcare data. The delayed detection and reporting further exacerbate risks, as prolonged exposure increases the likelihood of fraud, identity theft, or secondary attacks leveraging the stolen information. The breach underscores the critical need for robust email security measures and timely incident response in sectors managing highly sensitive data.