Alpine ENT Data Breach Affects 65,648 People, Exposing SSNs and Health Info

Alpine Ear, Nose, and Throat (alpineent.com), based in Fort Collins, Colo., recently experienced a data breach affecting 65,648 individuals across the United States, including 10 residents of Maine, 8 residents of New Hampshire, and 7 residents of Massachusetts.

Alpine ENT reported the breach to the U.S. Department of Health and Human Services on Jan. 17, 2025, listing 65,648 people affected. The Indiana Attorney General lists the same total, including 18 Indiana residents.

The incident was first discovered on Nov. 19, 2024, when Alpine ENT detected unauthorized activity within its systems.

Alpine ENT engaged its Managed Services Provider and a specialized cybersecurity firm to investigate and contain the breach. The forensic investigation confirmed that unauthorized access to personal information had occurred.

The BianLian ransomware group claimed responsibility for the attack in a dark web post on Dec. 1, 2024. Alpine ENT has not confirmed this claim.

Alpine ENT said a broad range of sensitive information may have been accessed, including both personally identifiable information (PII) and protected health information (PHI). The exposed data may include names, demographic information, dates of birth, medical and health insurance details, Social Security numbers, financial account information, credit card numbers, CVC codes, and credit card expiration dates.

The incident was disclosed to the attorneys general offices of Maine, Massachusetts, and New Hampshire; Alpine ENT has also posted a substitute notice on its own website.

Alpine Ear, Nose, and Throat's response

Upon discovering the breach, Alpine ENT worked to secure its systems and launched a forensic investigation to determine the extent of the incident. The company began a comprehensive review of the affected data, including data mining to identify impacted individuals and the types of information exposed.

This review ended on Oct. 9, 2025, and Alpine ENT finalized its notification list on Jan. 26, 2026. It mailed letters by first-class mail on Jan. 30, 2026. It had first posted a notice on its website on Jan. 17, 2025, while the investigation was still going on.

To support those affected, Alpine ENT is offering 12 or 24 months of free credit monitoring and identity theft restoration services through IDX, depending on the letter. Impacted individuals are encouraged to enroll in these services by following the instructions provided in their notification letter, which includes an enrollment code and a deadline of April 30, 2026.

People with questions can call IDX at 1-844-427-0772, Monday through Friday from 8 a.m. to 8 p.m. Central time, excluding U.S. holidays.

The company also provided guidance on placing fraud alerts and security freezes on credit files, as well as information on obtaining free credit reports and contacting the Federal Trade Commission.

Given the involvement of ransomware and the exposure of both PII and PHI, affected individuals should remain vigilant. It is recommended to:

• Enroll in the free credit monitoring service offered by Alpine ENT
• Regularly review account statements and credit reports for suspicious activity
• Consider placing a fraud alert or security freeze on credit files
• Report any suspected identity theft to local law enforcement and the FTC

The company has also enhanced its technical security measures and procedures to reduce the risk of future incidents.