Gastroenterology & Hepatology CNY: Social Security Numbers Exposed

Gastroenterology & Hepatology of Central New York, a medical practice in Liverpool, New York, that specializes in treating digestive and liver disorders, disclosed a data breach.

The breach was reported to the Massachusetts Office of Consumer Affairs and Business Regulation on Sept. 17, 2026, identifying 67 Massachusetts residents as affected. The company has posted a notice about the incident on its website.

On or around March 6, 2026, an unauthorized party accessed certain systems in the practice's network environment.

On April 11, 2026, a ransomware group known as Exitium posted a claim on the dark web, stating it had obtained data from the organization and intended to publish it within one to two days.

Following a forensic investigation and a file review conducted with external cybersecurity professionals, the company determined on Aug. 28, 2026, that the unauthorized third party had acquired records containing both personal information and protected health information.

The types of information exposed included full names, dates of birth, Social Security numbers, medical record numbers, phone numbers and addresses.

Gastroenterology & Hepatology of CNY's response to the breach

For questions or additional information about the incident, the company has set up a dedicated toll-free response line at 1-888-780-5190. The line is available from 9 a.m. to 9 p.m. Eastern time, Monday through Friday, excluding holidays. Individuals can also call this number to find out whether their information was involved in the breach.