Healthcare Data Breach Exposes Sensitive Patient Information for 15 Months

Heart Care Centers of Illinois reported a data breach resulting from a phishing attack that compromised an employee's email account from August 22, 2024, to November 6, 2024. The breach remained undetected until January 15, 2026, when the organization was investigating a separate phishing attempt. Sensitive information potentially accessed includes names, Social Security numbers, medical records, and financial data. Affected individuals were notified starting July 10, 2026, after a forensic investigation concluded on June 11, 2026. The breach has implications for cyber insurance and medical identity theft. Legal investigations for a potential class action lawsuit are underway. The total number of affected individuals has not been disclosed.

Key Points: • Unauthorized access to an employee's email account lasted for 76 days without detection. • Sensitive data exposed includes Social Security numbers, medical records, and financial information. • Legal investigations for a class action lawsuit are being initiated for affected individuals.