Access Sports Medicine breach exposed data on about 88,000 patients

Access Sports Medicine and Orthopaedics, an orthopaedic and sports medicine practice in New Hampshire, notified about 88,044 people in September 2024 that their personal and health information had been taken in a cyberattack earlier in the year.

The practice said it detected suspicious activity in its network environment on May 10, 2024, moved to secure the network and engaged an outside cybersecurity firm. Access Sports identified individuals whose personal health information was in the affected data on July 3, 2024 and again on July 19, 2024. Notification letters began going out on September 11, 2024.

Exposed data varied by person and included names, dates of birth, Social Security numbers, financial account information, medical information and health insurance information. The Inc Ransom group claimed the attack on its leak site on May 18, 2024 and appears to have published the stolen files in mid June. Access Sports did not verify the group's claims.

The practice told those affected that it had no evidence the information had been misused, and said it was notifying them out of transparency because their data had been disclosed. Twelve months of credit monitoring and identity theft protection were offered through Cyberscout, with enrollment open for 90 days from receipt of the letter.