Radiation Oncology Network of Southern California experienced a major data breach affecting multiple locations and tens of thousands of patients. The cybersecurity incident compromised both personally identifiable information (PII) and protected health information (PHI).
The breach occurred over a three-day period, from Dec. 13 to Dec. 16, 2024, due to an email phishing attack that resulted in unauthorized access of Integrated Oncology Network (ION) employee email and SharePoint accounts. Compromised information includes Social Security numbers, names, addresses, dates of birth, financial account information, diagnosis, lab results, medication, treatment information, health insurance and claims information, provider names, and dates of treatment.
Integrated Oncology Network, a company that owns and provides administrative services to several oncology practices, disclosed the data breach to Radiation Oncology Network of Southern California on June 13, 2025. Radiation Oncology Network of Southern California disclosed the cybersecurity incident to the U.S. Department of Health and Human Services on June 27, 2025.
The data breach was also reported to the California Attorney General's office on July 15, 2025. At least 12,944 patients were impacted by the incident.
In addition to required disclosures, affected patients can receive free Epiq Privacy Solutions ID credit monitoring services.
If you receive a data breach notice from Radiation Oncology Network of Southern California or Integrated Oncology Network about, you may want to: