A healthcare software company called Unlimited Technology Systems has disclosed that hackers broke into its servers in October 2025 and accessed patient data belonging to more than 3.8 million people. The company provides financial and revenue cycle management software to roughly 4,500 clinics and 6,500 specialty healthcare providers across the United States — meaning many of the affected individuals likely never heard of the company before receiving a breach notification.
Investigators determined that an unauthorized actor accessed files between October 5 and October 10, 2025. The company detected the intrusion on October 19 and began notifying patients on July 1, 2026, more than eight months later. The data exposed includes full names, Social Security numbers, dates of birth, email and mailing addresses, phone numbers, demographic information, driver’s license scans, insurance cards, intake forms, health insurance policy numbers, claims and benefits information, medical record numbers, dates of service, and diagnosis information. No ransomware group has claimed responsibility, and the perpetrators have not been identified. Affected individuals were offered identity monitoring through Kroll.