ALN Medical Management discloses 2024 breach of third-party hosted systems

ALN Medical Management, a Nebraska-based billing and revenue cycle management firm serving physician practices, disclosed in March 2025 that data had been exposed in an intrusion the previous year. The company is a subsidiary of Health Prime International, a Maryland-based medical billing group, and its client base has been described as spanning hundreds of practices and thousands of physicians.

ALN said it identified suspicious activity in March 2024 on systems hosted and managed by a third-party information technology provider. A forensic review determined that an unauthorized actor accessed and may have taken files and folders in that environment between March 18 and March 24, 2024.

The information involved varied by individual. It included names, Social Security numbers, driver's license numbers, other government-issued identification numbers such as passport and state identification card numbers, financial information including account and payment card numbers, health insurance details and medical information.

Identifying the affected individuals took roughly a year. ALN began mailing notification letters on March 21, 2025 and issued a public notice on March 24. The company had first reported the incident to the U.S. Department of Health and Human Services in May 2024 using a placeholder figure of 501 people. The total was later restated to 1,823,844 and subsequently revised down to 1,323,720. Multiple class action suits followed the disclosure, and ALN later agreed to a $4 million settlement.