Comprehensive Orthopaedics Data Breach: 21,897 Patients Affected

Comprehensive Orthopaedics & Musculoskeletal Care LLC, a privately owned orthopedic practice with four locations across Connecticut, disclosed a data breach that affected approximately 21,897 individuals in the United States.

The company posted a notice on its website, as well as disclosed the incident to the U.S. Department of Health and Human Services.

On Feb. 12, 2026, Comprehensive Orthopaedics became aware of suspicious activity related to its network.

Less than a month after the breach was discovered, on March 9, 2026, a ransomware group known as CRYPTO24 claimed responsibility for the attack on the dark web. The group stated that it had obtained the organization's data and intended to publish it within 15 to 16 days.

An investigation into the incident found that an unauthorized third party had accessed certain files stored on the company's network. Comprehensive Orthopaedics then conducted a thorough review of those files to determine whether they contained personal information or protected health information, and to identify which individuals may have been affected.

The review was completed on June 17, 2026, and confirmed that the affected files may have contained sensitive personal and protected health information.

The types of information exposed included names, dates of birth, Social Security numbers and government-issued identification numbers, financial account information and/or payment card information, medical information and health insurance information.

Comprehensive Orthopaedics' response to the breach

Comprehensive Orthopaedics is mailing notice letters to potentially affected individuals. These letters contain detailed information about what happened, what information was involved and what steps recipients can take to protect themselves from potential misuse of their information.

The company has set up a dedicated assistance line for individuals who have questions about the incident or the notification letters they received. The number is 203-265-3280, and representatives are available Monday through Friday from 9 a.m. to 5 p.m. ET, excluding holidays.