US healthcare software provider says intrusion exposed data of 3.8 million people
A five-day intrusion counted nine months later shows why third-party data handlers sit at the centre of healthcare breach risk.
Unlimited Technology Systems (UTS), an Ohio-based medical software provider, has said that data belonging to 3,803,750 people may have been copied during an intrusion at one of its commercial data centres, The Register reported on 7 August 2026. According to the US Department of Health and Human Services breach portal, that makes it the largest healthcare breach reported to the regulator so far in 2026, ahead of a TriZetto Provider Solutions incident that affected 3.4 million people.
The company detected the intrusion in October 2025 and later determined that an unauthorised party may have taken information between 5 and 10 October 2025. UTS disclosed the incident in July 2026 without initially saying how many people were affected. The total emerged through the HHS portal.
The exposed data varies by individual and may include names, Social Security numbers, dates of birth, postal and email addresses, phone numbers, demographic details, policy numbers, claims and benefits information, patient balances, medical record numbers, dates of service, diagnoses, and scanned copies of driver's licences, government IDs, insurance cards and intake forms. UTS said complete medical records, medical images, payment card numbers and bank account details were not involved.
UTS said it engaged a forensic security firm, notified law enforcement and established which files the intruder accessed. It has not identified the attacker or explained how access was gained, and no extortion group has publicly claimed the incident. Affected individuals are being offered 24 months of credit monitoring and identity protection, and the company said it was unaware of any misuse of the data at the time of the report.
Why it matters
The largest healthcare breaches increasingly occur at software and claims vendors that hold records for many providers at once, so one intrusion can expose more people than any single clinic could. Regulators and customers are pressing harder on third-party risk. The nine months between detection and a full count shows how slow that accounting still is.
- Unlimited Technology Systems3.8M
- TriZetto Provider Solutions3.4M
Figures: US Department of Health and Human Services breach portal, as reported by The Register
What you can learn from this
- Vendors concentrate risk by design. A software provider that processes claims or manages records for dozens of healthcare organisations holds a copy of each of their patient populations in one place. Under US health privacy rules such firms are business associates with their own obligations, but their customers remain responsible for choosing and monitoring them. The larger the vendor's footprint, the more attractive it is to attackers and the wider the blast radius when it fails. Contracts and security questionnaires are the main tools customers have for checking such a vendor, which is why they receive so much attention.
- Scoping a breach takes far longer than detecting it. Knowing that someone was inside for five days is only the start; investigators then have to reconstruct exactly which files were opened or copied and map those files to named individuals. That depends on having detailed access logs retained long enough to cover the intrusion window, and on data being organised so that a file can be linked to a person. Without both, the count stays uncertain for months, which is what delays notification. Retention of twelve months or more is common guidance precisely because intrusions are often discovered long after they occur.
- Retention decides how much a breach can hurt. Scanned identity documents and insurance cards are kept because they were once needed for verification, but every month they remain on disk they are exposure with no benefit. Data minimisation means storing only the fields a process actually requires and deleting or redacting the rest on a schedule. A breach of a system that holds five fields per person is a very different event from one that holds forty. Keeping only the last few digits of an identifier at rest is a widely used middle ground.
- Notification rules explain why numbers arrive late and in pieces. In the US, healthcare breaches affecting 500 or more people must be reported to HHS, and many states require separate notices to their attorneys general, each with its own deadline and format. Companies often disclose an incident first and file the headcount later once forensics conclude. Reading the regulator's portal is frequently the fastest way to learn the real scale.
- Segmentation limits how far an intruder can travel. A commercial data centre that hosts several systems must ensure that a foothold in one does not grant access to the rest, using separate network zones, distinct credentials and strict controls on administrative paths. When segmentation is weak, an intruder with a single set of credentials can reach every tenant's data. Identity boundaries matter as much as network boundaries in this setting.
We teach this
How to use this in practice
- Inventory the third parties holding one dataset you care about. Pick a single category of data, such as customer identity records or your own medical information, and list every external company that stores a copy, what fields they hold, and what the contract or privacy notice says about breach notification. Done looks like a table with one row per vendor and no blank cells. Mark any vendor where you cannot find a notification commitment, since those are the gaps to raise first. Keep the table somewhere you will find it again, since it becomes the checklist when a breach notice arrives.
- Test whether your logs could answer a five-day question. Choose one system you administer and check how long access logs are retained and whether they record which files or records were read, not just who logged in. Done looks like a written answer to the question: could I say which records were touched during a specific week nine months ago? If the answer is no, note whether retention length or log detail is the blocker and what it would take to fix. Write down who owns the logging configuration so the fix has a name attached.
- Run a minimisation pass on one folder or table. Search a shared drive or database you control for scanned identity documents, card images or ID numbers, note when each was last needed, and flag anything past its purpose for deletion or redaction. Done looks like a list of flagged items with a proposed action for each. Check whether the system has a retention setting that could automate the same clean-up in future, and record how many items you flagged as a baseline for the next pass.
- Draw the data flow for a healthcare record. Sketch patient, provider, software vendor, insurer and regulator as boxes, connect them with arrows showing where identity and claims data travels, and shade every box that stores a copy. Done looks like a diagram that makes clear how many copies of one person's record exist and which party controls each. Next to each shaded box, write who would notify you if that copy were breached.
Sources
Our reporting is an original summary; full coverage is at the links above.
Don't just read about it — build it.
Square 1 teaches the skills behind the headlines, with every line of your work graded by AI. Find your starting point in 3 minutes.
Get your free skill report