Aurora Emergency Physicians, LLC, an Illinois-based emergency medicine provider, suffered a data breach after an unauthorized actor accessed sensitive patient files maintained by its business associate, ApolloMD, between May 22–23, 2025. The breach exposed personally identifiable information (PII) and protected health information (PHI), including names, Social Security numbers, dates of birth, addresses, medical diagnoses, treatment details, provider names, and health insurance data.The compromised data significantly elevates risks of identity theft, financial fraud, and medical fraud, affecting thousands of patients across multiple affiliated practices. ApolloMD secured its systems, notified law enforcement, and began mailing breach notifications to victims on September 17, 2025, while offering free credit monitoring to those with exposed SSNs. The incident underscores severe vulnerabilities in healthcare data security, with potential long-term reputational and financial repercussions for the organization and its patients.