Infinite Services Data Breach Affects 31,742 People: SSNs & Health Info Exposed

On May 5, 2025, New York-based Infinite Services Inc. discovered a major data breach affecting both current and former employees as well as patients. The incident began when employees noticed they could not log into the company’s network. Investigation revealed that several servers were offline, and one server displayed a file extension linked to a known threat actor group. In response, Infinite Services immediately disconnected power to their entire network, which interrupted the ongoing encryption process. However, the threat actor had already accessed at least one server.

A third-party forensic firm and the FBI were engaged to investigate the breach. By June 23, 2025, Infinite Services determined that sensitive personal and health information was present on the compromised server. The breach exposed a range of personally identifiable information (PII) and protected health information (PHI), including names, addresses, Social Security numbers, dates of birth, financial account information, credit and debit card numbers, drivers license numbers, health insurance details, member identification numbers and medical records.

According to a disclosure filed with the Dept of Health & Human Services, the beach has affected at least 31,742 people in the U.S. In Massachusetts, 25 residents were impacted, while eight residents were affected in New Hampshire.

The breach was reported to the Massachusetts Attorney General on July 23, 2025, and to the New Hampshire Attorney General on July 22, 2025. Notification letters are scheduled for mailing on July 25, 2025.

Infinite Services' response

To support those affected, Infinite Services is offering complimentary identity protection services through IDX. Impacted individuals will receive 12 to 24 months of credit and CyberScan monitoring, a $1 million identity theft insurance policy with zero deductible, and access to fully managed identity theft recovery services.

The company recommends that affected individuals enroll in these services, remain vigilant by reviewing credit reports, bank statements and health insurance information, and promptly report any suspicious activity. Instructions for enrollment and additional resources are provided in the mailed notice.

More information about the company can be found on the Infinite Services website.