Excelas Data Breach Exposes Sensitive Medical and Personal Information Shamis & Gentile P.A., a class action law firm, is investigating a data breach at Excelas, a Richmond Heights, Ohio-based provider of medical-legal solutions. The incident, discovered on January 28, 2026, involved unauthorized access to Excelas’ systems between November 27 and December 3, 2025. Excelas, which serves healthcare organizations, insurers, and medical corporations, confirmed that cybercriminals accessed files containing sensitive personally identifiable information (PII) and protected health information (PHI). The exposed data includes names, Social Security numbers, medical records, insurance details, diagnosis information, and payment data. The CL0P ransomware group claimed responsibility for the attack, publicly posting about the breach on the dark web on January 23, 2026. Excelas is working with cybersecurity experts and law enforcement to assess the full scope of the incident. Affected individuals may be eligible for compensation under data protection laws, and legal investigations are underway to determine potential claims.