Orange County Radiation Oncology Medical Group experienced a data breach affecting multiple locations and tens of thousands of patients. The cybersecurity incident compromised both personally identifiable information (PII) and protected health information (PHI).
The breach occurred over a three-day period, from Dec. 13 to Dec. 16, 2024, due to an email phishing attack that resulted in unauthorized access of Integrated Oncology Network (ION) employee email and SharePoint accounts. Compromised information includes Social Security numbers, names, addresses, dates of birth, financial account information, diagnosis, lab results, medication, treatment information, health insurance and claims information, provider names, and dates of treatment.
Orange County Radiation Oncology Medical Group disclosed the cybersecurity incident to the U.S. Department of Health and Human Services on June 27, 2025. The company also began notifying affected individuals by mail on the same date and published a Notice of Email Phishing Incident on its own website.
The data breach was also reported to the California Attorney General's office on July 15, 2025. At least 1,911 patients were impacted by the incident.
In addition to required disclosures, affected patients can receive free Epiq Privacy Solutions ID credit monitoring services.
If you receive a data breach notice from Orange County Radiation Oncology Medical Group or Integrated Oncology Network about, you may want to:
More information about their services and approach can be found on the Orange County Radiation Oncology Medical Group website.