Columbia Orthopaedic Group Data Breach Exposes PHI

Columbia Orthopaedic Group, an orthopedic medical practice based in Columbia, Missouri, disclosed a data breach that affected individuals in the United States.

On May 25, 2026, a ransomware group called Lockbit 5.0 posted a claim on the dark web using the Tor network.

In the posting, the group stated it had obtained data belonging to Columbia Orthopaedic Group. The group also announced its intention to publish the stolen data within 14 to 15 days of the posting.

At this time, it is not known from publicly available sources whether the group followed through on its threat to release the data. The specific types of personal information or protected health information that may have been accessed or taken during this incident have not been detailed in the available disclosures.

The breach was reported to the U.S. Department of Health and Human Services on June 18, 2026.

Columbia Orthopaedic Group's response to the breach

Current or former patients of Columbia Orthopaedic Group who are concerned about whether their personal or health information was affected are encouraged to contact the practice directly for the most current information about the breach and any resources being offered.

Individuals should watch for correspondence from the company and read them carefully for details about what information was involved and what protective steps the company recommends.