Cunningham Prosthetic Care Data Breach Exposes PHI and PII

Cunningham Prosthetic Care LLC, a family-owned prosthetic and orthotic practice based in Saco, Maine, disclosed a data breach that it discovered on Oct. 22, 2025. The company has not disclosed the total number of individuals affected by the breach across the United States.

The breach was reported to the Massachusetts Office of Consumer Affairs and Business Regulation on May 1, 2026. Cunningham Prosthetic Care additionally posted a notice about the incident on its website.

The breach centered on a compromised Cunningham Prosthetic Care email account. An unauthorized individual may have gained access to the account on or about Oct. 22, 2025.

As part of the investigation, the company worked closely with external cybersecurity professionals who are experienced in handling these types of security incidents. The investigation took several months to complete as the cybersecurity team worked to determine the full scope of the unauthorized access, review the contents of the compromised email account and identify which files may have been affected.

On March 4, 2026, more than four months after the breach was initially discovered, cybersecurity professionals determined that the affected files may contained both personal information and protected health information.

The types of personally identifiable information exposed included full names, dates of birth, Social Security numbers and driver's license numbers. The types of protected health information exposed included medical treatment and diagnostic information, medical record numbers and health insurance information.

Cunningham Prosthetic Care's response to the breach

Affected individuals who were notified received detailed guidance from the company on best practices to help protect their personal and medical information.

For individuals with questions about the incident or who need additional information, Cunningham Prosthetic Care has set up a dedicated toll-free response line at 1-833-877-4472. The response line is available for 90 days between the hours of 8 a.m. and 8 p.m. Eastern time, Monday through Friday, excluding holidays.

Steps to take if your information was exposed

• Place a fraud alert on credit files by contacting one of the three major credit bureaus: Equifax (1-800-525-6285), Experian (1-888-397-3742) or TransUnion (1-800-680-7289), which will then notify the other two bureaus automatically.
• Consider placing a security freeze on credit reports to prevent new credit, loans or services from being approved without express authorization.
• Request free credit reports at AnnualCreditReport.com and review them carefully for any unfamiliar accounts or unauthorized inquiries.
• Review Explanation of Benefits statements from health insurers for any medical services or charges that are not recognized, and contact the insurance company or care provider about any unfamiliar items.
• Watch for phishing attempts that reference Cunningham Prosthetic Care or this data breach by name, as scammers sometimes use breach notifications to trick people into sharing more personal information.
• Report suspected identity theft to the Federal Trade Commission at ftc.gov/idtheft or by calling 1-877-438-4338, and consider filing a police report if any fraudulent activity is detected.