Columbia Medical Practice Data Breach Affects 94,131 People

On Nov. 5, 2025, Columbia Medical Practice experienced a data breach that affected 94,131 people.

According to the notice of cybersecurity event, a then-unknown cybercriminal accessed a portion of the practice’s computer network and installed ransomware, locking files on their systems.

The attacker also copied files from the network that same day. The Qilin ransomware group later claimed responsibility and posted about the attack on the dark web on Nov. 24, 2025.

The information exposed in this breach is both extensive and sensitive. It includes personally identifiable information (PII) such as names, addresses, phone numbers, dates of birth, Social Security numbers, driver’s license numbers, passport numbers and other government identifiers.

In addition, protected health information (PHI) was compromised, including location of health services, dates of service, treatment or condition information, diagnosis and diagnosis codes, prescription details, medical history, assigned physician and health insurance subscriber or identification numbers.

Financial information was also affected, such as patient account numbers and financial account numbers (without security codes, access codes or passwords).

The breach was reported to the U.S. Department of Health and Human Services on Dec. 5, 2025. Starting on April 24, 2026, it also reported the breach to the attorneys general of Maine and Massachusetts.

Six Massachusetts residents and about three Rhode Island residents were among those notified.

Columbia Medical Practice's response

Columbia Medical Practice finished reviewing the copied files on March 31, 2026. It began sending notice letters to affected people on April 24, 2026, and is offering free credit monitoring through Cyberscout, a TransUnion company.

To support those potentially impacted, Columbia Medical Practice published a detailed notice of cybersecurity event on their website. The notice provides guidance on how to protect personal information, including instructions for monitoring credit reports, placing fraud alerts or security freezes and contacting the major credit bureaus.

The practice has also set up a toll-free assistance line at 1-833-974-3375, available Monday through Friday from 8 a.m. to 8 p.m. Eastern time, to answer questions and provide further assistance.

Given that the breach resulted from a ransomware attack and involved the theft of sensitive PII and PHI, it is important for affected individuals to remain vigilant. Monitoring financial accounts and credit reports for suspicious activity is strongly recommended.

Individuals should also consider placing a fraud alert or security freeze with the credit bureaus to help prevent identity theft. Additional resources and instructions are available in the official notice and from consumer protection agencies.