Comprehensive Orthopaedics Data Breach: 21,897 Patients Affected

Comprehensive Orthopaedics & Musculoskeletal Care LLC, a privately owned orthopedic practice with four locations across Connecticut, disclosed a data breach that affected approximately 21,897 individuals in the United States.

The company posted a notice on its website, and disclosed the incident to the U.S. Department of Health and Human Services on Sept. 10, 2026.

So far, the breach has affected 87 Massachusetts residents and 34 New Hampshire residents. Comprehensive Orthopaedics began mailing notification letters on Oct. 26, 2026.

On Feb. 12, 2026, Comprehensive Orthopaedics became aware of suspicious activity related to its network.

Less than a month after the breach was discovered, on March 9, 2026, a ransomware group known as CRYPTO24 claimed responsibility for the attack on the dark web. The group stated that it had obtained the organization's data and intended to publish it within 15 to 16 days.

An investigation into the incident found that an unauthorized third party had accessed certain files stored on the company's network. Comprehensive Orthopaedics then conducted a thorough review of those files to determine whether they contained personal information or protected health information, and to identify which individuals may have been affected.

The review was completed on June 17, 2026, and confirmed that the affected files may have contained sensitive personal and protected health information.

The types of information exposed included names, dates of birth, Social Security numbers and government-issued identification numbers, financial account information and/or payment card information, medical information and health insurance information.

Comprehensive Orthopaedics' response to the breach

Comprehensive Orthopaedics is offering affected individuals 12 or 24 months of complimentary credit monitoring and identity protection services through IDX. Individuals can enroll at app.idx.us with the code in their letter. The deadline to enroll is Jan. 26, 2027.

The company has set up a dedicated assistance line for individuals who have questions about the incident or the notification letters they received. The number is 203-265-3280, and representatives are available Monday through Friday from 9 a.m. to 5 p.m. ET, excluding holidays. Individuals who received a letter can also call 1-866-200-0885.