Contained High impact Ransomware Checked 1d ago

Unlimited Systems breach exposes 3.8 million patients

A ransomware attack on Unlimited Technology Systems exposed personal, medical and insurance data for about 3.8 million people. The attacker copied data from the healthcare software company's data center in October 2025. A patient filed a federal lawsuit on August 13, 2026. HHS still lists the breach as under investigation, and no continuing attacker access has been reported.

Started
Oct 5, 2025
Latest activity
Sep 10, 2026
Attributed to
Not confirmedNo credible attribution yet
Where
United States
Sectors
Healthcare, Technology
Scale
one healthcare technology vendor serving thousands of medical practices

Current status

On September 10, 2026, HHS still listed the breach as under investigation, with no public closure or renewed access reported.

Contained: The attack has been stopped or blocked. Recovery and investigation are still running.

Impact

Stolen files may contain names, Social Security numbers, contact details, diagnoses, treatment details, insurance information and scanned identity documents. The company said complete medical records, medical images and payment account details were not exposed.

What to do

People who receive a notice should enroll in the offered identity protection, consider freezing their credit and check medical and insurance statements for unfamiliar activity.

Timeline

  1. Sep 10, 2026

    HHS's live breach portal still listed Unlimited Technology Systems under cases currently under investigation.

    Containedocrportal.hhs.gov
  2. Sep 9, 2026

    PKWARE's monthly breach report said the incident remained under investigation and that no threat actor had been publicly named.

    Containedpkware.com
  3. Aug 13, 2026

    A patient filed a federal lawsuit against Unlimited Technology Systems over the breach. The claims have not been decided.

    Containeddockets.justia.com
  4. Aug 11, 2026

    Unlimited confirmed the incident was ransomware while its investigation remained open.

    Containedmedcitynews.com
  5. Aug 7, 2026

    The federal breach portal listed 3,803,750 affected people.

    Containedtheregister.com
  6. Oct 19, 2025

    Unlimited discovered the activity, hired forensic investigators and notified law enforcement.

    Containedsecurityaffairs.com
  7. Oct 10, 2025

    The reported period of unauthorized access ended.

    Containedsecurityaffairs.com
  8. Oct 5, 2025

    An unauthorized actor began copying information from the company's commercial data center.

    Activetheregister.com

Sources

Related reports