An Ohio revenue cycle management software vendor has confirmed that an unauthorized actor copied insurance policy numbers, claims and benefits data, Social Security numbers and diagnoses belonging to 3,803,750 people. Unlimited Technology Systems LLC (UTS) detected the intrusion in one of its commercial data centers in October 2025, disclosed it in July 2026, and was added to the HHS Office for Civil Rights breach portal on August 6, 2026, roughly ten months after the fact. The company's own notification letter, filed with the Iowa Attorney General's Office and reported by SecurityWeek, The Register, HIPAA Journal and Insurance Business, puts the exfiltration window at October 5 to October 10, 2025. No ransomware or extortion group has claimed the attack, and UTS has not named a threat actor or explained the initial access vector.
What Happened
The reported timeline is consistent across sources. UTS identified unauthorized activity within a commercial data center containing personal and protected health information on October 19, 2025, according to Insurance Business. Forensics later placed the attacker inside between October 5 and October 10, meaning the intruder had been operating for roughly two weeks before detection and had already staged and copied data by the time anyone noticed.
UTS engaged an outside forensic security firm, notified law enforcement, and began the file-by-file review that determines who has to be notified. That review is what consumed the intervening months. The company disclosed the incident in July 2026 without a victim count, then reported 3,803,750 affected individuals to HHS in late July. The portal entry followed on August 6.
Two details in the sourcing do not line up. On location, SecurityWeek and Insurance Business both place UTS in Montgomery, Ohio, while HIPAA Journal describes it as Cincinnati-based (Montgomery is a Cincinnati suburb, which likely explains the discrepancy rather than a factual dispute). On ranking, the accounts genuinely differ: The Register called it "the largest healthcare breach reported to regulators so far this year," while HIPAA Journal, which tracks the OCR portal directly, ranks it second largest for the year to date, ahead of the 3.4 million-record Trizetto Provider Solutions breach but behind a 15 million-record breach at DentaQuest. HIPAA Journal's framing is the more specific and more checkable of the two.
Scale of the customer base gives the number context. SecurityWeek notes UTS claims to work with more than 4,500 oncology offices and over 6,500 specialty providers, so the 3.8 million figure is aggregated across a long tail of downstream practices, most of which are far too small to have vetted this vendor meaningfully.
What Was Taken
Per the Iowa AG notification, the exposed fields vary by individual but span the full identity-plus-benefits set:
- Names, dates of birth, home and email addresses, phone numbers and other demographic data
- Social Security numbers
- Medical record numbers, diagnoses and dates of service
- Insurance policy numbers, claims and benefits information, and patient balances
- Scanned images of driver's licenses and other government IDs, insurance cards, and patient intake forms
UTS has been explicit about the limits: the files did not contain complete medical records, medical imaging, credit card numbers or bank account details. The company also says it is not aware of any attempted or actual misuse of the data, and is offering two years of credit monitoring, fraud consultation and identity theft restoration.
That "no clinical records" caveat undersells the risk. As Insurance Business argues, the combination actually taken is arguably more operationally useful to a fraudster than a chart would be. A policy number plus a claims history plus a scanned insurance card and a government ID image is a working kit for medical identity theft and benefits fraud: enough to impersonate a member to a payer, submit or redirect claims, or build a convincing pretext against a plan's call center. SSNs and dates of birth are static and cannot be reissued the way a card number can.
Why It Matters
This is a business associate breach, and that category now dominates the healthcare loss column. HIPAA Journal reports that six of the top ten breaches disclosed this year occurred at business associates, as did half of the largest healthcare breaches on record. The economics are obvious: compromise one back-office billing vendor and you reach thousands of providers at once, without touching a single hospital network.
The surrounding months make the pattern hard to dismiss as coincidence. Over the same window, TechCrunch reported that U.K.-based billing software maker Craneware, whose products are used by thousands of U.S. clinics, hospitals and pharmacies, was responding to an intrusion in which a "significant volume" of employee, customer and partner data was exfiltrated (Craneware acquired Sentry in 2021, gaining access to what it described at the time as 147 million patient records). TechCrunch separately reported that CareCloud, which stores records for more than 45,000 providers, is notifying at least 345,000 people after attackers spent six days in an AWS-hosted EHR data store in March. And BleepingComputer and SecurityWeek reported that Georgia-based billing firm MCBS disclosed 1,261,464 affected individuals from a September 2025 intrusion. Four billing and revenue cycle intermediaries, four separate disclosures, all within roughly a year.
The MCBS case is the useful contrast for defenders. There, SecurityWeek reports the PEAR ransomware group publicly claimed the hack in late September 2025, alleged more than 3 TB of stolen files, and published the data. UTS has no such claimant. Silence is not reassurance. Unclaimed data theft often means a quiet buyer, a broker resale, or an actor holding leverage for later, and it removes the one signal that usually tells downstream customers their patients' records are already circulating.
The disclosure lag is its own finding. Ten months between intrusion and portal listing means affected patients spent nearly a year unable to freeze credit or watch for fraudulent claims against data that was already gone. The regulatory fix is not imminent either: the proposed HIPAA Security Rule update, which tightens business associate security and covered entity vendor oversight, has slipped, with OCR now expecting a final rule by July 2027.
The Attack Technique
There is no confirmed technique. UTS has not disclosed initial access, and both The Register and SecurityWeek note the company has neither named an actor nor explained how the intruder reached the data center. No group has claimed responsibility on a leak site.
What the record does support is a behavioral profile rather than a TTP chain: access to a commercial data center environment, a five-day bulk collection and copy window from October 5 to 10, detection on October 19 only after the exfiltration had completed, and no encryption or service disruption reported. That is a data-theft-only operation, consistent with the broader shift away from encryption toward pure extortion or straight resale. Anything beyond that, including vector, dwell time before October 5, and whether a ransom was demanded, is unknown. Treat any confident claim about the entry point as speculation.
What Organizations Should Do
For health plans, providers and brokers with exposure to billing intermediaries:
- Inventory the second tier, not just the first. Ask every clearinghouse, RCM vendor and practice management provider which subprocessors touch member data, where it is hosted, and how long it is retained. The UTS victims are overwhelmingly small practices that almost certainly never audited the data center in question.
- Contract for detection timelines, not just notification timelines. A five-day exfiltration that took two weeks to notice and ten months to quantify is the actual failure here. Push BAAs toward defined intrusion-detection commitments, forensic scope deadlines, and a hard clock on individual notification independent of the investigation's completion.
- Treat policy numbers and claims history as authentication-grade secrets. If your call center or member portal accepts a policy number, member ID or claims detail as a knowledge-based verification factor, those factors are now compromised for millions of people. Move to out-of-band verification for benefits changes, address updates and claim redirections.
- Watch for benefits fraud, not just credit fraud. Credit monitoring does not detect fraudulent claims filed against a member's policy. Payers should hunt for anomalous claim submissions, new-provider patterns, and out-of-area service locations tied to affected member IDs.
- Minimize retained scans. Driver's license, government ID and insurance card images inside intake workflows are high-value and rarely need indefinite storage. Purge or tokenize them on a defined schedule.
- Log and alert on bulk read patterns in data stores. In UTS, MCBS and CareCloud alike, the damaging action was large-scale reading and copying of records, not privilege escalation fireworks. Volumetric access alerting on record stores catches that class of activity; endpoint-centric detection frequently does not.
Sources: Health tech vendor breach hits 3.8 million patients' benefits data... | Intrusion at US healthcare software provider puts 3.8M people's dat... | Hackers stole 'significant' amount of data from tech firm relied on... | 3.8 Million Impacted by Unlimited Technology Systems Data Breach -... | Patient Data Exposed in Cybersecurity Incident at Ohio Revenue Cycl... | Data breach at medical billing firm MCBS affects 1.26 million people | CareCloud begins to notify hundreds of thousands after hackers stol... | MCBS Data Breach Affects 1.2 Million Individuals - SecurityWeek