Between January 27, 2025, and February 6, 2025, Episource, LLC, a provider of risk adjustment services for the healthcare industry, experienced a major data breach affecting several thousand individuals. The cybersecurity incident exposed both both personally identifiable information (PII) and protected health information (PHI).
The breach was discovered on February 6, 2025, when Episource detected unusual activity in its computer systems. An investigation determined that a cybercriminal had gained unauthorized access and was able to view and copy sensitive data stored on Episource’s systems during this period.
The data breach was disclosed to the Texas Attorney General's office on June 10, 2025, with at least 24,259 individuals in Texas affected. Episource published a Notice of Data Breach on a dedicated response website on April 23, 2025.
Information exposed is extensive and may include names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, health insurance information (health plans, policies, insurance companies, member/group ID numbers, and Medicaid-Medicare-government payor ID numbers), medical record numbers, diagnoses, names of doctors, prescribed medications, test results, images and care and treatment details.
Episource took steps to contain the incident by shutting down affected computer systems and notifying law enforcement. On April 23, 2025 Episource began notifying customers with information about which individuals may have been impacted.
If you receive notification from Episource or your provider about this breach, you may want to:
For affected individuals with questions, Episource has set up a call center at 877-786-2549, Monday through Friday, 8 a.m. to 8 p.m. CT.
To learn more about the company, visit the Episource website.