Premier Medical Group of the Hudson Valley P.C. (PMG), a multi-specialty physician practice headquartered in Poughkeepsie, New York, is notifying patients that an unauthorized party accessed files containing their personal and protected health information during a June 2026 intrusion. PMG reported 282,075 affected individuals to the U.S. Department of Health and Human Services, and SecurityWeek reports that HHS added the incident to its breach portal during the week of September 16, 2026. The practice's own notification letters, as summarized by local outlet WPDH and by several class action monitoring sites, describe an incident that began with a disruption to PMG's IT systems and ended with confirmed unauthorized access to patient files on a single date: June 14, 2026. No threat actor has claimed the attack, and PMG has not described the intrusion vector.
What Happened
The timeline reconstructed across sources is consistent. PMG became aware of an incident that disrupted the operations of some of its IT systems in June 2026. The practice says it moved to secure its network, engaged third-party forensic experts, and notified law enforcement. That investigation determined an unauthorized party had accessed files stored on PMG systems on June 14, 2026.
Determining what was in those files took another month. WPDH and ClaimDepot both report, citing the notification letter, that the review did not conclude until July 14, 2026. PMG then began mailing notification letters to affected patients on August 21, 2026, and posted a notice of data security incident to its website. That is a roughly 68-day gap between confirmed access and first patient notification, which is within the HIPAA Breach Notification Rule's 60-day clock measured from discovery but leaves patients unaware for more than two months after their data moved.
PMG is a significant regional provider. SecurityWeek describes coverage across cardiology, dermatology, gastroenterology, neurology, plastic surgery, gynecology, and internal medicine. Class action filings add urology, rheumatology, and podiatry, and list main offices in Poughkeepsie, Fishkill, Hopewell Junction, New Windsor, Newburgh, Wappingers Falls, and Kingston. WPDH characterizes PMG as one of the Hudson Valley's largest medical practices, with locations across Dutchess, Ulster, and Orange counties.
Two of the supplied sources add context rather than detail. HIPAA Journal's September 4, 2026 roundup lists Premier Medical Group of the Hudson Valley among several healthcare breach announcements that week, but its substantive reporting in that piece concerns an unrelated vendor ransomware incident at 3C Care Systems affecting Midwest Spine and Brain Institute. There is no reported link between the two events. The Massachusetts Office of Consumer Affairs breach notification archive for August 2026 is indexed here as a regulatory reference point and does not itself supply PMG-specific detail.
What Was Taken
The victim's own notification, as reproduced across WPDH, ClaimDepot, and Class Action U, identifies the following data elements as potentially involved:
- Patient names
- Contact information
- Dates of birth
- Health insurance information
- Provider names
- Internal patient identification numbers
- Dates of service
- Medication information
- Treatment and/or diagnostic information
On volume, the sources converge rather than conflict. SecurityWeek's headline figure is "over 280,000," while the precise number PMG reported to HHS, cited by both SecurityWeek and ClaimDepot, is 282,075 individuals. Treat 282,075 as the operative regulator-reported count.
One discrepancy is worth flagging plainly. WPDH reports that the notification letter does not indicate Social Security numbers or financial account information were involved. ClaimDepot's case page, however, carries a sidebar listing Social Security numbers, government IDs, addresses, and financial information among "types of information affected," while that same page's article text lists only the nine elements above and its own sidebar closes with "affected information types not yet disclosed." The sidebar appears to be generic lead-generation boilerplate attached to a claims intake form, not reporting drawn from the notification. Nothing in PMG's described letter supports SSN or financial account exposure. Until PMG or HHS says otherwise, the defensible position is that this is a PHI and demographic breach without a confirmed SSN component.
That distinction matters less than it might sound. Diagnosis, medication, and treatment detail combined with insurance policy data is the exact bundle used for medical identity theft and fraudulent claims, and unlike a Social Security number it cannot be reissued. PMG's own guidance reflects this: the practice told patients to review statements from providers and health plans and to contact them immediately about services they did not receive. That is insurance fraud monitoring advice, not credit monitoring advice.
Why It Matters
A regional multi-specialty practice holding 282,075 patient records is a high-value, comparatively soft target. It carries hospital-scale data volume without hospital-scale security budget or staffing, and the specialty mix here (urology, gynecology, neurology, dermatology, plastic surgery, gastroenterology) means the diagnostic data involved is disproportionately sensitive and disproportionately usable for extortion or coercion against individual patients.
The absence of an extortion claim is the most analytically interesting feature of this incident. SecurityWeek reports it has seen no known ransomware or extortion group claim responsibility. The reported facts are nonetheless consistent with a ransomware-adjacent intrusion: IT systems disruption as the discovery trigger, followed by confirmed file access. Several readings fit. The intrusion may have been disrupted before deployment, a ransom may have been paid quietly, the actor may be running an unbranded operation, or the data may simply be queued for a later leak site posting. Defenders should not read "no claim" as "no exfiltration." PMG's framing is that files were accessed; whether they were taken off the network is not addressed in any source here.
The class action apparatus mobilized ahead of the regulator listing, which is now the norm. Shamis & Gentile announced an investigation on August 24, 2026, three days after notification letters went out and roughly three weeks before HHS posted the incident. The broader Console & Associates investigation index shows the same pattern running across a dozen-plus healthcare and financial breaches in August 2026 alone. Litigation exposure now begins on the mailing date, not the portal date.
The Attack Technique
Not established. PMG has not shared details on how the attack occurred or who was behind it, and no source in this set offers a vector, malware family, or attribution.
What can be inferred from the reported facts is limited and should be treated as such. The discovery path was operational disruption to IT systems rather than an alert, a third-party notification, or an extortion demand, which suggests the intrusion was not detected until it produced visible impact. The one-month gap between confirming June 14 access and completing the data review on July 14 is characteristic of investigations where forensic artifacts or file listings must be reconstructed to establish scope, rather than cases where an actor's staged exfiltration archive is recovered intact.
Anyone reporting a specific vector, ransomware family, or actor name for this incident is going beyond what PMG or HHS has released.
What Organizations Should Do
Healthcare providers of comparable size should treat this as a prompt to check the controls that would have shortened PMG's timeline:
- Instrument bulk file access, not just endpoints. The gap between "systems were disrupted" and "we know which files were touched" is a logging gap. Enable and retain file server, EHR, and document repository audit logs long enough to answer scope questions in days rather than a month, and alert on abnormal read volume per account.
- Segment file shares away from clinical systems. The data here was in files, not necessarily the EHR. Flat shares holding decades of patient documents are the most common source of six-figure record counts at practices this size. Inventory them, then restrict access by department and role.
- Enforce phishing-resistant MFA on every remote entry point. VPN, remote desktop, email, and any vendor or billing portal. Unattributed intrusions at practices this size overwhelmingly begin with valid credentials on an interface without strong MFA.
- Pre-build the notification package now. PMG needed 38 days from data review completion to first letter. Having templated letters, a call center contract, and a mapping from patient records to current mailing addresses ready in advance compresses that materially and reduces regulatory and litigation exposure.
- Extend the same review to vendors. The HIPAA Journal roundup that named PMG was primarily about a managed service provider compromise reaching a clinic through data it had handed over. Inventory which third parties hold your PHI, what fields they hold, and whether their contracts obligate them to notify you on a defined clock.
- Advise patients on medical identity fraud specifically. Where diagnosis, medication, and insurance data is involved but Social Security numbers are not, the operative controls are explanation-of-benefits review and provider statement review, as PMG itself instructed. Offer identity monitoring where SSNs are in scope, but do not let credit monitoring substitute for claims monitoring.
Patients seeking information can reach PMG's dedicated incident response line at 888-650-4197, Monday through Friday, 9 a.m. to 9 p.m. Eastern, per the practice's notice.
Sources: 280,000 Impacted by Premier Medical Group Data Breach - SecurityWeek | Midwest Spine and Brain Institute Impacted by Vendor Ransomware ... | Thousands of Hudson Valley Patients' Data Stolen; Was Yours? | Premier Medical Group Data Breach Impacts 282k | Premier Medical Group Data Breach Lawsuit - Class Action U | Premier Medical Group Data Breach Lawsuit Investigation | Data Breach Class Action Lawsuits Active Investigations | Data Breach Notification Letters August 2026 - Mass.gov