An unauthorized actor gained access to certain OADC systems of Orthopedic Associates of Dutchess County in New York. The types of data involved included patients’ names, addresses, telephone numbers, email addresses, emergency contact, guarantor, patient identification number, medical record number, diagnosis information, health insurance number, and other health insurance information, payment details, date of birth, Social Security number, and treatment information. They investigated the incident and offered 12 months of identity and credit monitoring.

On or around March 1, 2021, Orthopedic Associates of Dutchess County (OADC) suffered a data breach due to unauthorized access to their systems. The incident exposed sensitive personal and financial information of 331,376 individuals, including 91 Maine residents. Compromised data included names, Social Security numbers, and bank account details, heightening risks of identity theft and financial fraud. Affected individuals were notified via written correspondence on May 4, 2021, nearly two months after the breach. As a remedial measure, OADC offered one year of identity theft protection services through Experian. The breach underscored vulnerabilities in the organization’s cybersecurity defenses, particularly in safeguarding highly sensitive personally identifiable information (PII) and financial records. The scale of the breach and the nature of the exposed data suggest severe reputational and operational consequences for OADC, alongside potential legal and regulatory scrutiny.