A revenue cycle management vendor that almost no patient has heard of has become one of the largest healthcare data breaches reported to US regulators this year. Unlimited Technology Systems, LLC (UTS), an Ohio-based provider of practice management and revenue cycle software, has confirmed that an unauthorized actor copied files containing insurance policy numbers, claims and benefits data, Social Security numbers and diagnoses belonging to 3,803,750 people. The figure comes from the company's own report to the HHS Office for Civil Rights, filed in late July 2026 and posted to the OCR breach portal on August 6. Every outlet reviewed for this brief cites the same count, 3,803,750, so there is no meaningful spread in the record numbers. The disagreements sit elsewhere: on whether this was ransomware, on where the company is headquartered, and on whether it is the largest or second-largest healthcare breach of 2026.
What Happened
The intrusion is nearly a year old. UTS detected unauthorized activity inside one of its commercial data centers in October 2025. Insurance Business puts the detection date specifically at October 19, 2025; the other outlets say only "October 2025." The forensic investigation determined that the attacker copied data between October 5 and October 10, 2025, meaning the actor was operating inside the environment for roughly two weeks before anyone noticed, if the October 19 detection date holds.
Becker's Hospital Review adds a detail no other source carries: that the compromised environment hosted the company's g4-Centricity for Vector platform. Becker's also describes the incident flatly as a ransomware attack. That characterisation is not supported elsewhere. SecurityWeek states that UTS has not named a threat actor and that it has seen no known extortion or ransomware group claiming the attack. HIPAA Journal says the same, and The Register notes UTS has not explained how the intruder got in. Treat "ransomware" as a single-outlet characterisation, not an established fact.
There is also a location discrepancy. SecurityWeek and Insurance Business place UTS in Montgomery, Ohio. HIPAA Journal describes the company as Cincinnati-based. Montgomery is a Cincinnati suburb, so this is likely the same office described at two levels of granularity rather than a substantive conflict.
The disclosure timeline is the more uncomfortable number. The data was copied in early October 2025. UTS reported the affected-individual count to OCR on July 21, 2026 according to Becker's, described as "late July" by SecurityWeek and Insurance Business. HHS posted it on August 6. That is roughly nine to ten months between exfiltration and public scale.
What Was Taken
UTS described the exposure in a notification letter filed with the Iowa Attorney General's Office, which SecurityWeek obtained as a PDF and which The Register and Insurance Business also cite. Depending on the individual, the copied files may have contained:
- Names, home and email addresses, phone numbers, dates of birth and other demographic data
- Social Security numbers
- Medical record numbers
- Diagnoses and dates of service
- Insurance policy numbers, claims and benefits information
- Patient balances (per The Register)
- Scanned driver's licenses, government IDs, insurance cards and patient intake forms
UTS has been equally specific about what was not involved: no complete medical records, no medical imaging, and no financial account data such as credit card or bank account numbers. The company also says it has no evidence of attempted or actual misuse of the data, and a spokesperson told Becker's in July that it had directly notified all customers whose data was believed to be involved. Affected individuals are being offered two years of credit monitoring, fraud consultation and identity theft restoration.
The absence of full clinical records should not be read as a mitigation. As Insurance Business argues, this particular combination is arguably more useful to a fraudster than a chart would be. A policy number plus a subscriber's identity documents plus an active benefits profile is the raw material for medical identity theft and fraudulent claims submission, and unlike a credit card number, a policy number is not trivially rotated.
Where UTS sits in the 2026 rankings depends on who is counting. The Register calls it "the largest healthcare breach reported to regulators so far this year." HIPAA Journal calls it the second-largest year to date, ahead of the 3.4 million-record Trizetto Provider Solutions breach but behind a 15 million-record breach at DentaQuest. HIPAA Journal is the more specific claim and shows its comparison set, so it is the stronger one, but the accounts do differ and readers should not treat either superlative as settled.
Why It Matters
This is not an isolated vendor failure. It is the fourth healthcare data-handling intermediary to surface in roughly three weeks of reporting, and the pattern is the story.
On July 20, TechCrunch reported that UK-based healthcare billing software maker Craneware was responding to an attack in which hackers stole a "significant volume" of customer data, disclosed via a London Stock Exchange filing. Craneware said only that a "percentage" of employee, customer and partner records had been exfiltrated, and did not specify data types. TechCrunch noted that Craneware's 2021 acquisition of Sentry brought it access to 147 million patient records.
On July 28, BleepingComputer reported that Medical Computer Business Services, a regional billing firm in Augusta, Georgia, had disclosed a September 2025 network intrusion affecting 1,261,464 people, exposing SSNs, health plan beneficiary numbers, policy numbers, subscriber IDs and treatment and diagnosis information across at least seven covered entities.
On July 30, TechCrunch reported that CareCloud, which stores patient records for more than 45,000 US providers, had begun notifying at least 345,000 people after attackers accessed one of its six patient data stores, hosted on AWS, between March 10 and 16, 2026.
HIPAA Journal supplies the structural framing: six of the top ten breaches reported this year occurred at business associates, as did half of the largest healthcare breaches of all time. The economics are obvious to an attacker. Compromising one billing vendor yields the aggregated data of hundreds of practices, and the affected patients have no relationship with that vendor, no visibility into it, and no ability to opt out of it.
The regulatory response is lagging. The proposed update to the HIPAA Security Rule includes measures to tighten business associate security and strengthen vendor oversight, but HIPAA Journal reports that the final rule, originally planned for mid-2026, has slipped to an expected July 2027 release.
The Attack Technique
Initial access is unknown. UTS has not publicly explained how the intruder reached the commercial data center, and no source in this set offers a vulnerability, a phishing vector or a credential-abuse theory. No threat group has claimed responsibility, and no extortion leak site posting has been reported.
What can be said about attacker behaviour is limited to the shape of the operation: dwell inside a hosted environment, stage and copy bulk files rather than encrypt-and-announce, and exit. The five-day copy window (October 5 to 10) against a detection date that Insurance Business puts nine days later is consistent with an exfiltration-first operation that was noticed only after the data was already gone. Becker's ransomware framing would imply an encryption or extortion component, but nothing else in the reporting corroborates it, and the absence of any claiming group cuts against it.
Post-incident, UTS says it suspended access to the hosted systems, engaged a forensic security firm, notified law enforcement, and ran a file-level review to determine what had been accessed. That review is what took months, and it is the standard reason for the gap between intrusion and notification in aggregator breaches: reconstructing which downstream customer's patients appear in which copied file is slow, manual work.
What Organizations Should Do
- Inventory your business associates by data type, not by contract value. The vendors that matter most are the ones holding policy numbers, subscriber IDs and identity document scans, not the ones with the biggest invoices. Most organisations cannot currently answer "which vendor holds our patients' scanned driver's licenses" in under a day. That is the gap.
- Ask vendors specifically about hosted and commercial data center environments. UTS was breached in a commercial data center, CareCloud in an AWS-hosted data store. Vendor security questionnaires that stop at the vendor's corporate network miss the environment where the data actually sits.
- Contract for detection and notification timelines, and enforce them. Ten months from exfiltration to a public record count is the norm in this sector, not an outlier. Business associate agreements should specify notification triggers on detection, not on completion of file review, so covered entities can begin their own downstream assessment in parallel.
- Treat insurance policy numbers as durable identifiers requiring rotation planning. Unlike payment cards, policy and subscriber numbers are rarely reissued after a breach. Plan sponsors and payers should have a documented position on when they will reissue and what fraudulent-claim monitoring they run in the interim.
- Hunt for bulk-read and bulk-export activity, not just encryption. In each of the four incidents cited here, the damage was exfiltration. Detection engineering that keys on ransomware behaviours will miss a five-day copy operation. Alert on anomalous volume of database reads, archive creation and egress from data stores that normally serve query traffic.
- Direct affected individuals to medical-specific protections. Credit freezes and fraud alerts address SSN misuse but do nothing about fraudulent claims filed against a policy. Advise members to review explanation-of-benefits statements for services they did not receive and to request accountings of disclosures from their providers.
Sources: Health tech vendor breach hits 3.8 million patients' benefits data... | Hackers stole 'significant' amount of data from tech firm relied on... | Data breach at medical billing firm MCBS affects 1.26 million people | 3.8 Million Impacted by Unlimited Technology Systems Data Breach -... | Patient Data Exposed in Cybersecurity Incident at Ohio Revenue Cycl... | CareCloud begins to notify hundreds of thousands after hackers stol... | Intrusion at US healthcare software provider puts 3.8M people's dat... | Ransomware breach at health IT vendor tops 3.8 million patients - B...