Unlimited Technology Systems (UTS), a Montgomery, Ohio healthcare software and revenue cycle vendor, is formally notifying 3,803,750 people that an unauthorized actor copied their personal, medical and insurance data from one of its commercial datacenters in October 2025. The count is not an estimate: it is the figure UTS itself filed with the U.S. Department of Health and Human Services' Office for Civil Rights in late July 2026, which added the company to its public breach portal on August 6. All three outlets covering the filing (The Register, SecurityWeek and The Daily Hodl) cite the same 3,803,750 number, with The Register and SecurityWeek rounding to 3.8 million in their headlines. There is no meaningful conflict in the record on scale. The Register assesses it as the largest healthcare breach reported to U.S. regulators so far this year.
What Happened
UTS provides financial and revenue cycle technology to healthcare providers. SecurityWeek notes the company claims to work with more than 4,500 oncology offices and over 6,500 specialty providers, which explains how a vendor most patients have never heard of ended up holding records on nearly four million of them.
The timeline, drawn from the notification letter UTS filed with the Iowa Attorney General's Office and quoted directly by The Daily Hodl, runs as follows. The intruder had access and copied data between October 5 and October 10, 2025. UTS says it discovered unauthorized activity in its commercial datacenter on October 19, 2025, roughly nine days after the exfiltration window closed. The company then engaged an outside forensics firm, notified law enforcement, and began the data review that determines who has to be told what.
That review took a long time. The Register reports UTS disclosed the breach in July 2026 without initially stating how many people were affected, and the scale only became public when the HHS portal entry appeared on August 6, some ten months after discovery. The Daily Hodl characterises the individual notifications as having gone out "abruptly," but no source explains the gap between the July regulatory disclosure and the August portal listing beyond the standard file review.
Two things remain unknown and are worth stating plainly. UTS has not said how the intruder got into the datacenter, and it has not named the actor. Neither The Register nor SecurityWeek has seen any ransomware or extortion group claim the intrusion, and SecurityWeek reports the company says it is unaware of any attempted or actual misuse of the data.
What Was Taken
The exposed data set is unusually broad for a healthcare incident because a revenue cycle vendor sits at the junction of clinical and billing systems and therefore holds both.
Per the Iowa filing as reported by The Register and SecurityWeek, the stolen files may include, depending on the individual: names, Social Security numbers, dates of birth, home and email addresses, phone numbers, driver's license numbers and other demographic details. On the clinical and insurance side: medical record numbers, diagnoses, dates of service, insurance policy numbers, claims and benefits information, and patient balances. The Register adds that the files may also have contained scanned images of driver's licenses and other government IDs, insurance cards, and patient intake forms.
UTS has drawn explicit boundaries around the exposure, using identical language across its notification and every outlet that quoted it: the data does not include full patient medical records, medical imaging, or financial information such as credit card or bank account numbers. That limit is real but narrow. A record combining a Social Security number, a date of birth, a scanned government ID and a diagnosis code is a complete identity fraud and medical fraud package on its own, with or without a card number attached.
Affected individuals are being offered two years of complimentary identity monitoring through Kroll, covering credit monitoring, fraud consultation and identity theft restoration.
Why It Matters
This is a vendor breach, not a provider breach, and that distinction is the entire story. Not one of the 3.8 million people receiving a letter chose to do business with Unlimited Technology Systems. They saw an oncologist or a specialist; the billing flowed downstream into a vendor's datacenter, and the vendor got hit.
The other incidents in this reporting cycle make the same point from different angles, and they are separate events with no established connection to UTS:
- CareCloud. TechCrunch reported on July 30, 2026 that the New Jersey health tech firm, which stores patient records for more than 45,000 providers, began notifying at least 345,000 people that hackers accessed one of its six electronic health record data stores between March 10 and March 16, 2026, in AWS-hosted storage. TechCrunch says a hacker claimed to have exfiltrated data from databases, and that it is unaware of any group publicly taking credit.
- Metabase and Framework. BleepingComputer reports that an unauthenticated SQL injection zero-day in Metabase versions 1.58 and above, rated CVSS 10.0 with no CVE assigned at the time of writing, was exploited against Metabase Cloud, giving a remote attacker administrator access to customer instances. Laptop maker Framework told TechCrunch that "all customers" were notified after names, email addresses, phone numbers and physical addresses were taken; The Register adds login IP addresses, and for business customers company names, VAT or EIN numbers, and billing email addresses. Framework says order and payment details were not affected. Per The Register, Metabase discovered the attack on August 3 and notified Framework at 9am Pacific on August 6.
- ChainDrop. Microsoft Threat Intelligence published analysis on August 4, 2026 of an npm supply chain attack affecting more than 400 packages across unrelated publishers, including keyv, flat-cache and cache-manager, delivering a self-propagating credential-stealing worm.
Four separate stories, one shared structure: the compromise happens somewhere the data owner does not control, and the blast radius is defined by whoever the third party serves. The counts differ wildly (3.8M for UTS, ~345K for CareCloud, unspecified "all customers" for Framework), but the failure mode does not.
The Attack Technique
For UTS specifically, the honest answer is that the initial access vector is not public. The company has said only that it detected unauthorized activity within its commercial datacenter and that files were copied over a five-day window. No exploit, no phishing lure, no credential abuse has been named, and no actor has claimed it. Treat any attribution you see elsewhere as unsupported by the current record.
What the surrounding incidents do show is the range of techniques currently succeeding against the vendor layer. Metabase's case is a straightforward unauthenticated SQLi zero-day against a managed SaaS control plane, where administrator access on the analytics instance converts directly into stored credentials for every connected database. Microsoft's ChainDrop analysis describes something more mechanical: a heavily obfuscated Bun-based payload executing through an npm preinstall lifecycle hook, harvesting npm, GitHub, AWS, Kubernetes and HashiCorp Vault credentials from workstations and CI/CD environments, exfiltrating over attacker-controlled HTTPS with GitHub repositories as a fallback channel, then republishing trojanised versions of any package the stolen publishing token can reach. Microsoft also notes the malware injects Claude and Visual Studio Code configuration files into repositories for persistence and developer-to-developer spread.
The common denominator across all of them is that the attacker never needed to touch the organisation whose data ultimately leaked.
What Organizations Should Do
- Inventory your revenue cycle and business intelligence vendors by data class, not by contract value. UTS is a billing technology provider holding diagnoses and Social Security numbers. Metabase is an analytics tool holding credentials to every database it queries. Neither looks like a crown jewel on a vendor spreadsheet.
- Assume dwell time exceeds detection time and instrument accordingly. UTS detected the intrusion on October 19 for activity that ran October 5 to 10. Egress monitoring on bulk data movement out of datacenter environments is what closes that gap, not endpoint alerts alone.
- Patch Metabase now if you self-host. BleepingComputer reports Metabase Cloud customers were upgraded automatically, but self-hosted installations on 1.58 and above must be updated manually and are confirmed under active exploitation at CVSS 10.0.
- Rotate every credential reachable from a compromised analytics or BI instance. Framework's response, per The Register, was to rotate credentials for every database connected to its Metabase instance and then verify no admin changes or lateral movement occurred. That is the correct playbook for any SaaS control plane compromise.
- Harden the build pipeline against lifecycle-hook execution. Following Microsoft's ChainDrop findings: disable npm install scripts by default, pin dependencies with lockfiles, scope publishing tokens narrowly, and alert on unexpected patch-version republishes of packages you own.
- Write vendor breach notification timelines into contracts. Metabase notified Framework three days after discovery. UTS's affected individuals waited roughly ten months from discovery to a public headcount. The difference between those two response profiles is contractual, not technical.
- For individuals in the UTS notification population, freeze credit rather than relying solely on monitoring. Monitoring reports fraud after it happens; a freeze prevents new account opening, which is the primary risk when SSN, DOB and scanned government ID move together.
Sources: 3,803,750 Americans Warned After Hackers Hit Software Firm – Names,... | ChainDrop supply chain compromise: Anatomy of a self-propagating wo... | Metabase SQLi zero-day exploited in customer data-theft attacks | Computer maker Framework notifies 'all customers' of a data breach... | Framework loses customer data in Metabase zero-day attack | Intrusion at US healthcare software provider puts 3.8M people's dat... | CareCloud begins to notify hundreds of thousands after hackers stol... | 3.8 Million Impacted by Unlimited Technology Systems Data Breach -...