A data breach at CPAP Medical Supplies and Services, Inc., a Jacksonville, Florida-based defense contractor, exposed the sensitive personal and medical data of 90,133 military members, veterans, and their families. The unauthorized intrusion, discovered in late June (though occurring in December), compromised a wide range of information, including names, birth dates, Social Security numbers, patient IDs, health insurance details, medical histories, diagnoses, and treatment plans. The breach also impacted sleep data tracked by CPAP devices, which monitor users with obstructive sleep apnea.The company, which partners with Tricare (the military’s health insurer), is offering 12 months of free credit and identity monitoring to affected individuals. While notifications were sent in mid-August, the breach has been reported on data breach tracking sites for Maine, Massachusetts, and Washington but remains absent from the Texas Attorney General’s tracker and the U.S. Department of Health and Human Services (HHS) breach database. External cybersecurity experts are investigating the full scope of the compromise, though the delay in detection raises concerns about prolonged exposure of highly sensitive military-affiliated health records.

In December 2024, CPAP Medical Supplies and Services Inc., a Jacksonville-based provider of sleep therapy services and CPAP machines, suffered a cybersecurity breach compromising the personal data of over 90,000 patients, primarily military members, veterans, and their families. An unauthorized actor accessed the network between December 13–21, 2024, exfiltrating sensitive information including full names, birth dates, Social Security numbers, health insurance details, medical histories, and treatment plans. The breach remained undetected until June 2025, with notifications sent by mid-August. While no confirmed misuse of data has been reported, the exposure poses severe risks—including identity theft, fraud, blackmail, compromised benefits eligibility, and erosion of trust in healthcare providers—given the victims' military affiliations. The company offered free credit monitoring and identity theft protection as a precautionary measure, but the long-term consequences for affected individuals remain critical.