MSBI Data Breach Exposed PHI and PII Including Social Security Numbers

Midwest Spine and Brain Institute (MSBI), an independent medical clinic in Minnesota specializing in spine, brain and neurological care, disclosed a data breach involving its third-party managed service provider, 3C Care Systems LLC.

The breach was reported to the Massachusetts Office of Consumer Affairs and Business Regulation. The company discovered on June 18, 2026, that patient information had been compromised, according to its notification letters to affected individuals. Midwest Spine and Brain Institute also posted a notice of the incident on its website.

The breach resulted from an external cyber-attack on 3C Care Systems LLC, a third-party managed service provider used by Midwest Spine and Brain Institute. An unauthorized actor gained access to 3C's network environment on or about Nov. 21, 2024.

After learning of the attack on its vendor, Midwest Spine and Brain Institute opened an investigation with the assistance of external cybersecurity professionals experienced in handling these types of incidents. The company worked closely with these professionals to assess the full scope of the breach and identify whose information may have been affected.

3C Care Systems also conducted its own independent forensic investigation with the help of cybersecurity professionals.

The company confirmed that its own larger network was not compromised by the incident. The breach was limited to systems within the vendor's environment.

After an extensive forensic investigation and complex manual document review, Midwest Spine and Brain Institute determined that the compromised systems contained personal information belonging to its patients.

The types of personally identifiable information (PII) potentially exposed included full names, dates of birth and Social Security numbers.

Protected health information (PHI) that may have been compromised included medical treatment information, procedure and diagnosis details, medical record numbers, medical provider information, medical prescription information, dates of service, and health insurance claim and/or policy information.

Midwest Spine and Brain Institute's response to the breach

The company is offering complimentary credit monitoring services for 12 months. The services include single bureau credit monitoring, a single bureau credit report and a single bureau credit score, provided through Cyberscout.

Affected individuals must enroll within 90 days of the date of their notification letter using a unique code provided in the letter.

Individuals with questions about the incident can contact the company by email at HIPAA@midwestspine.net. A toll-free response line has also been established for affected individuals, with the specific phone number included in individual notification letters. The response line is available Monday through Friday, 8 a.m. to 8 p.m. EST, excluding major U.S. holidays.