Unlimited Technology Systems: Ransomware Breach Hits 442,000 Patients

Unlimited Technology Systems LLC, a Montgomery, Ohio practice management and revenue cycle software vendor doing business as Unlimited Systems, has notified at least 442,000 patients that an intruder copied their personal and medical information out of the commercial datacenter hosting its platform. The company discovered the activity on October 19, 2025, but forensics placed the actual data theft between October 5 and October 10, 2025, meaning the files were already gone by the time anyone noticed. Notification letters did not reach patients until roughly nine months later. The 442,000 figure comes from state attorney general filings tallied by Becker's Hospital Review and MedRisk; HIPAA Journal and HEAL Security both noted the incident had not yet appeared on the HHS Office for Civil Rights breach portal at the time of their reporting, so the official federal count remains unpublished.

What Happened

The sequence is consistent across every source. An unauthorized actor gained access to a commercial datacenter environment operated on behalf of Unlimited Systems and, between October 5 and October 10, 2025, obtained copies of files containing patient data belonging to the vendor's healthcare provider clients. Unlimited identified the unauthorized activity on October 19, 2025, retained a third-party cybersecurity and digital forensics firm, and notified law enforcement.

Where accounts differ is on the ransomware element. MedRisk describes the incident explicitly as a ransomware attack in which systems inside the commercial datacenter hosting the g4-Centricity for Vector platform were encrypted. Becker's Hospital Review, HIPAA Journal and HEAL Security, working from the same notification letter and Iowa AG filing, describe unauthorized access and file exfiltration without confirming encryption or naming an extortion group. No source in this set names a ransomware brand, publishes a ransom note, or points to a leak site listing. Treat the encryption detail as reported by one outlet rather than as multi-source confirmed fact. What all sources agree on is data theft.

The disclosure timeline is unusually long and also inconsistently reported. A sample notice was filed with the Iowa Attorney General's office on July 1, 2026. Unlimited told at least one provider client, Hematology and Oncology Consultants, about the incident on May 20, 2026, roughly seven months after discovery; that practice's own notice says Unlimited began notifying individuals with known contact information on or about June 20, 2026. Becker's and MedRisk report notification beginning July 21, 2026, and Settlement Insight refers to letters going out in late July 2026. The most likely reading is a rolling notification campaign spanning June and July 2026 rather than a single mailing date, but the sources do not reconcile cleanly. Settlement Insight also reports that the mailings were handled through breach response firm Kroll, which is why recipients saw a "Return to Kroll" envelope.

What Was Taken

Exposure varied by individual. Combining the notification letter language reported by HIPAA Journal, HEAL Security, the Iowa filing summarized by Becker's, the sample notice described by ClassAction.org, and the client notice posted by Hematology and Oncology Consultants, the affected categories include:

• Names, addresses, email addresses, phone numbers and demographic information
• Dates of birth
• Social Security numbers
• Health insurance information, including policy numbers and claims or benefits data
• Patient balance information
• Medical information, including medical record numbers, dates of service and diagnosis details
• Scanned documents, including driver's licenses and other government ID, insurance cards and intake forms

Unlimited states that full patient medical records, medical imaging, and financial account information such as credit card and bank account numbers were not involved, and that it has no evidence of misuse. Class Action U additionally lists driver's license numbers as a discrete data element, consistent with the scanned ID documents described elsewhere.

On volume, the reported figures do not resolve to a single number. Becker's and MedRisk put the total at at least 442,000 patients based on state filings. Iowa's attorney general filing alone covers roughly 162,000 residents and South Carolina's lists about 148,000, with California, Massachusetts, Texas and Vermont residents also affected. Those two states account for about 310,000 of the 442,000, so the aggregate is a floor built from partial state disclosures, not a company-confirmed total. HIPAA Journal and HEAL Security explicitly declined to state a number, citing the absence of an OCR portal entry. Expect the final federal figure to land at or above 442,000.

Why It Matters

This is a business associate breach, and the blast radius belongs to organizations that were never attacked. Unlimited Systems provides financial and practice management technology to specialty providers nationwide, and Settlement Insight reports that its client base includes several cancer centers. Patients whose records were taken may have no idea the company exists. Every downstream provider inherits notification duties, reputational damage and litigation exposure from a compromise inside somebody else's datacenter.

Two structural failures stand out. First, detection lag: the exfiltration window closed on October 10 and discovery came on October 19, so the actor operated undetected through the entire theft. Second, notification lag: roughly nine months elapsed between discovery and patient letters, with at least one provider client left uninformed for seven of those months. A provider that learns in May 2026 about an October 2025 breach cannot meaningfully protect its own patients, and its HIPAA clock is being set by a vendor's pace, not its own.

The data mix also matters. Social Security numbers plus dates of birth plus scanned government ID and insurance cards is an identity theft and medical identity fraud package, not a nuisance disclosure. Diagnosis information and dates of service raise the stakes further for oncology patients, where the fact of treatment is itself sensitive. Twenty-four months of monitoring, offered as credit monitoring in the HIPAA Journal and HEAL Security accounts and as identity monitoring in the Becker's and MedRisk accounts, does not expire the usefulness of a stolen SSN.

Legal exposure is already forming. ClassAction.org and Class Action U both confirm attorneys are soliciting affected individuals, and Settlement Insight lists the matter as active litigation with no settlement reached as of July 2026.

The Attack Technique

Initial access has not been disclosed. No source in this set identifies an exploited vulnerability, a compromised credential, a phishing vector, or a named threat group. What can be stated from the reporting is the shape of the intrusion: the actor reached a commercial datacenter environment holding multi-tenant patient data, staged and copied files over a roughly five day window from October 5 to October 10, 2025, and, according to MedRisk's account alone, encrypted systems in that environment.

That pattern is the standard modern healthcare extortion playbook. Exfiltration precedes or replaces encryption, the target is a service provider rather than a hospital, and the leverage comes from aggregated data across many client organizations. The absence of a named group and the absence of any reported leak site posting leaves open whether a ransom was paid, whether the data was published, or whether the actor simply moved on. Defenders should assume the data is in circulation regardless of the vendor's no-evidence-of-misuse language, which describes what has been detected, not what exists.

What Organizations Should Do

1. Inventory business associates by data sensitivity, not contract value. Identify every vendor that holds SSNs, diagnosis data or scanned identity documents on your behalf. A small revenue cycle vendor can hold more regulated data than your largest software supplier.
2. Write detection and notification SLAs into BAAs with teeth. Require notice to you within days of vendor discovery, not months. The seven month gap between Unlimited's October 2025 discovery and its May 2026 client notification is the failure mode to contract against.
3. Instrument for egress, not just intrusion. The theft here completed before discovery. Prioritize outbound volume baselining, anomalous archive creation and bulk database export alerting in hosted environments, and require that vendors demonstrate equivalent controls.
4. Ask where the data physically lives. This breach occurred inside a commercial datacenter environment, not the vendor's corporate network. Map the hosting layer, its segmentation between tenants, and who holds administrative credentials to it.
5. Pre-build your downstream notification playbook. Assume a vendor will hand you a completed investigation and a short fuse. Have template letters, call center capacity and state-by-state filing requirements ready before you need them.
6. Extend monitoring beyond the offer window and warn patients about medical identity fraud. Twenty-four months of monitoring does not cover the useful life of the exposed data. Advise affected individuals to review explanation of benefits statements for care they did not receive, place credit freezes, and treat unsolicited insurance or provider contact as suspect.

Sources: Ransomware at Ohio vendor triggers notices for 442,000 patients – M... | Patient Data Exposed in Cybersecurity Incident at Ohio Revenue Cycl... | Health IT vendor breach exposes 442,000 patients' data - Becker's H... | Unlimited Systems Data Breach Lawsuit - Class Action U | Unlimited Systems Data Breach Reported; Lawyers Investigating | Unlimited Systems Data Breach: No Settlement Yet (July 2026) Settl... | Notice of Data Breach | Patient Data Exposed in Cybersecurity Incident at Ohio Revenue Cycl...