Unlimited Technology Systems Suffers Massive Healthcare Data Breach Affecting 3.8 Million Patients Ohio-based health tech vendor Unlimited Technology Systems disclosed a ransomware attack that compromised the data of approximately 3.8 million patients, making it the second-largest healthcare breach reported to HHS this year. The incident occurred between October 5 and 10, with notification letters sent to affected individuals last month. Unlimited, which processes billing for 4,500 oncology practices and 6,500 specialty providers, confirmed that hackers accessed its commercial data center, exposing sensitive patient information, including Social Security numbers, medical records, diagnosis and treatment details, and scanned insurance cards. The company has not disclosed whether a ransom was paid or how attackers initially breached its systems. The investigation remains ongoing, and security researchers warn the total number of affected individuals could rise. The breach underscores the growing risk of third-party vendor attacks in healthcare. Six of this year’s ten largest healthcare breaches involved vendors handling claims, billing, or records prompting HHS to propose stricter HIPAA Security Rule requirements for vendor oversight, though the rule has yet to be finalized. The incident aligns with broader trends: ransomware attacks on healthcare companies surged 46% in July alone, with provider-targeted attacks up 20% year-over-year, according to Comparitech. Another medical billing vendor, Craneware Group, also reported a July breach involving nearly a terabyte of stolen data. Given the rising frequency of such attacks, Unlimited’s breach may soon be surpassed in scale.

Healthcare Software Vendor Unlimited Technology Systems Discloses 2025 Data Breach Affecting Patient Data Unlimited Technology Systems LLC, a Montgomery, Ohio-based healthcare software and revenue cycle management provider, reported a data breach that exposed sensitive patient information in October 2025. The incident, disclosed to the Iowa Attorney General on July 1, 2026, was discovered by the company on October 19, 2025, following unauthorized activity in its commercial datacenter. Between October 5 and October 10, 2025, an unauthorized actor accessed and potentially copied personally identifiable information (PII) and protected health information (PHI) belonging to patients of the company’s healthcare provider clients. Exposed data included names, Social Security numbers, dates of birth, contact details, government-issued IDs, insurance cards, and intake forms. Medical information such as insurance policy numbers, claims details, medical record numbers, and diagnosis data was also compromised. However, the breach did not involve full medical records, imaging, or financial account numbers. As part of its response, Unlimited Technology Systems is providing affected individuals with two years of free identity monitoring through Kroll, accessible via an activation code and verification ID included in notification letters. Support is available via a dedicated helpline during business hours. The total number of impacted individuals remains undisclosed.