Western Orthopaedics Data Breach Exposes Patients' Personal and Health Information

Western Orthopaedics P.C., one of Denver's longest-running orthopedic surgery practices, disclosed a data breach involving patients' personal and health information. A total of 113,330 individuals were impacted, including 363 Texas residents, 100 Montana residents and 46 Massachusetts residents.

An unauthorized third party accessed and acquired certain data from the practice's systems between approximately Sept. 17, 2025, and Sept. 25, 2025. As part of its investigation, Western Orthopaedics conducted an analysis, which concluded on March 3, 2026, to determine whether personal information was present in the affected data.

The types of personally identifiable information exposed included full names and addresses, phone numbers, Social Security numbers, dates of birth and financial account, credit or debit card numbers (with or without security codes, access codes or passwords).

Protected health information was also exposed, including health insurance information, health insurance plan or subscriber identification numbers, medical provider names, medical dates of service and medical cost or billing information.

On Oct. 4, 2025, a ransomware group known as PEAR claimed responsibility for the attack on a Tor-based dark web site. The group claimed to have obtained the organization's data.

Western Orthopaedics' response to the breach

Western Orthopaedics notified affected individuals by U.S. Mail.

The company is offering complimentary credit monitoring and identity protection services through Epiq at no cost to affected individuals. The services include one-bureau credit monitoring with alerts, dark web monitoring, credit freeze assistance, change of address monitoring and identity restoration support.

For questions about the breach, affected individuals can call the dedicated incident response line at 855-815-3938, available Monday through Friday from 8 a.m. to 8 p.m. Central Time.