IPPC Data Breach Exposes Sensitive PII and PHI in 2025 Incident Innovative Pharmacy Packaging Corp. Inc. (IPPC) and its affiliates IPPC of New York LLC and Innovative Pharmacy LLC reported a data breach that occurred in September 2025, affecting at least two Massachusetts residents. The company disclosed the incident to the Massachusetts Office of Consumer Affairs and Business Regulation on April 1, 2026, and posted a public notice on its website on February 27, 2026. Affected individuals received notification letters dated April 1, 2026. The breach was detected after IPPC identified suspicious activity on its technical network. An investigation revealed that an unauthorized actor accessed the system between September 18 and 19, 2025, and exfiltrated files. A detailed review of the compromised data, completed by February 9, 2026, confirmed exposure of both personally identifiable information (PII) and protected health information (PHI). Exposed PII included: - Names, dates of birth, and government-issued ID numbers - Payment card and financial account details - Social Security numbers, passport numbers, and taxpayer identification numbers - Prescription, billing, and claims information Exposed PHI included: - Medicare/Medicaid IDs and health insurance details - Diagnosis, treatment, and procedure records - Medical record and patient account numbers - Provider names and admission/discharge dates In response, IPPC is offering 24 months of free credit and identity monitoring through Cyberscout (a TransUnion company) to affected individuals, with enrollment required within 90 days of notification. The company has also established a dedicated helpline (833-877-7455) and email ([email protected]) for inquiries. The breach’s scope and sensitivity particularly the exposure of Social Security numbers and medical records heighten risks of identity theft and fraud.

IPPC Data Breach Exposes Sensitive Patient and Financial Information Across Six States In a significant cybersecurity incident, IPPC a long-term care pharmacy services provider operating under IPPC of New York and Innovative Pharmacy disclosed a data breach involving unauthorized access to its network. The breach occurred over a two-day period (September 18–19, 2025), during which an unknown actor copied and potentially viewed sensitive files. A review of the affected data, completed by February 9, 2026, revealed that compromised information may include: - Personal identifiers: Names, birth dates, Social Security numbers, driver’s license/government ID numbers, passport numbers, and taxpayer identification numbers. - Medical data: Medicare/Medicaid IDs, diagnosis/treatment details, medical record numbers, prescription information, provider names, and admission/discharge dates. - Financial records: Payment card details, bank account information, billing/claims data, and health insurance information. IPPC serves patients across New York, New Jersey, Pennsylvania, Delaware, Maryland, and Virginia. The company has begun notifying affected individuals, though the full scope of the breach remains under investigation. Legal professionals are examining the incident to determine whether a class action lawsuit could be filed on behalf of impacted individuals, citing potential harms such as privacy violations, financial losses, and time spent mitigating the breach’s effects. The investigation aims to hold IPPC accountable for safeguarding the entrusted data.