Unlimited Technology Systems (UTS), an Ohio-based practice management and revenue cycle software vendor, has confirmed that an unauthorized actor accessed its commercial datacenter in October 2025 and may have copied personal and protected health information belonging to millions of patients. The company's own notification letters, filed with the Iowa attorney general and reported by The Register, describe unauthorized access between 5 and 10 October 2025. The US Department of Health and Human Services breach portal now lists the incident as affecting 3,803,750 people, which The Register and HIPAA Journal both report makes it the largest healthcare breach filed with US regulators so far in 2026. Notifications to affected individuals began on 21 July 2026, roughly nine months after the intrusion window.
Counts published before the HHS filing were substantially lower. MedRisk, citing Becker's Hospital Review and ClaimDepot, reported "at least 442,000" patients on 2 August 2026 based on state-level attorney general filings. The figures are not necessarily contradictory, since state filings capture only residents of that state, but readers should treat 442,000 as an early partial tally and 3,803,750 as the current regulator-reported total.
What Happened
According to the sample notice UTS submitted to the Iowa Attorney General's Office on 1 July 2026, as described by ClassAction.org and echoed in the Mary Bird Perkins Cancer Center notification, the company detected unusual activity within its commercial datacenter on 19 October 2025. UTS engaged an outside cybersecurity forensic firm, notified law enforcement, and began the file-by-file review needed to determine whose data had been touched. That review concluded an unauthorized actor had access between 5 and 10 October 2025, meaning the intrusion went undetected for roughly nine days before discovery and took an additional nine months to translate into individual notifications.
Accounts differ on the nature of the attack. The Register, reporting on UTS statements, describes only unauthorized access and possible copying of data, with no mention of encryption or extortion. MedRisk characterises the incident as a ransomware attack that encrypted systems inside the datacenter hosting the g4-Centricity for Vector platform. That ransomware framing appears in only one lower-tier source and is not corroborated by UTS's own filings as reported elsewhere, so it should be treated as unconfirmed. UTS has not publicly named a threat actor, and no group has been credibly linked to the breach in any of the available sourcing.
The blast radius extends well beyond UTS itself. Mary Bird Perkins Cancer Center, a nonprofit cancer care provider in Baton Rouge, Louisiana, told its patients that the breach did not originate in its own systems but at its software vendor. MedRisk reports state-level exposure figures of roughly 162,000 Iowa residents and about 148,000 South Carolina residents, with California, Massachusetts, Texas and Vermont also affected.
What Was Taken
UTS's notification describes a data set that varied by individual but could include names, Social Security numbers, dates of birth, home and email addresses, phone numbers, and other demographic information. On the clinical and financial side, the exposed files may have contained health insurance policy numbers, claims and benefits information, patient balances, medical record numbers, dates of service, and diagnosis information.
The most damaging category is documentary. The company confirmed that the affected files may also have included scans of driver's licenses and other government identification, insurance cards, and patient intake forms. Scanned identity documents are considerably harder to remediate than a leaked SSN alone, because they support synthetic identity creation and medical identity fraud that credit monitoring will not catch.
UTS did set limits on the exposure. The company stated the files did not contain complete medical records, medical images, credit card numbers, or bank account details, and said it has no evidence the data has been misused. MedRisk reports the vendor is offering 24 months of free identity monitoring to affected individuals.
Why It Matters
This is a third-party incident in which almost none of the 3.8 million affected people had a direct relationship with the breached company. UTS holds data on patients of specialty practices nationwide because those practices outsourced revenue cycle operations to it. The patients never chose UTS, cannot audit it, and in most cases learned of its existence from a breach letter.
The scale comparison matters for anyone benchmarking vendor risk. Sentinel.ht notes the tally pushes UTS past the TriZetto Provider Solutions incident at 3.4 million, another revenue cycle management vendor. Two of the largest recent US healthcare breaches sit in the same narrow layer of the supply chain: the billing and practice management intermediaries that aggregate claims data across dozens of unrelated providers. That aggregation is precisely what makes them efficient targets.
The nine-month gap between discovery and notification is also worth flagging. Providers relying on UTS could not warn their own patients until the vendor completed its file review, which left downstream organisations like Mary Bird Perkins carrying the reputational cost of an incident they neither caused nor controlled the timeline for.
The Attack Technique
Initial access remains unexplained. UTS has not publicly described how the intruder reached its commercial datacenter, and no source in this set provides a technical entry vector, malware family, or infrastructure indicator. Defenders should not assume a specific technique here.
For sector context rather than attribution, Health-ISAC issued a 24 July 2026 advisory, reported by BleepingComputer, warning of a rise in successful ShinyHunters attacks against healthcare and medical technology organisations. That campaign chain begins with voice phishing aimed at employees or helpdesk staff to trigger password resets, MFA method changes, or new device enrolment, then pivots through an Okta, Microsoft Entra, or Google SSO dashboard into connected SaaS platforms including Salesforce, Microsoft 365, SharePoint, DocuSign, Slack, Atlassian, Dropbox and Google Drive. The group is also known for supply chain compromises of third-party integration partners that yield OAuth tokens for platforms like Salesforce and Snowflake.
To be explicit: no source connects ShinyHunters to the UTS breach. The advisory is included because it describes the dominant current attack pattern against this exact sector during the same period, and because the UTS case fits the broader supply chain victim profile, not because any evidence ties the two together.
What Organizations Should Do
-
Inventory downstream vendors and their data holdings. If you outsource revenue cycle management, practice management, or claims processing, document exactly which patient fields each vendor holds and where that data physically lives. MedRisk's framing is correct: the lesson here is that a single vendor incident ripples across patients of dozens of unrelated organisations.
-
Put notification timelines in your contracts. The nine-month lag between UTS discovering activity on 19 October 2025 and notifications starting 21 July 2026 left providers unable to inform their own patients. Contractually require vendor notification to you within days of detection, independent of their completion of forensic file review.
-
Harden the helpdesk against social engineering. Per the Health-ISAC advisory, the current attack chain against healthcare begins with vishing to force password resets, MFA changes, or device enrolment. Require out-of-band identity verification for any credential or MFA reset, and treat new device enrolment as a high-risk event requiring manager or security approval.
-
Audit SSO and OAuth blast radius. A single compromised SSO account exposes every application in the user's dashboard. Reduce standing access, enforce phishing-resistant MFA (FIDO2 or passkeys) on identity provider accounts, and review third-party OAuth grants and integration tokens on a recurring schedule, revoking anything unused.
-
Instrument datacenter and file access for bulk-read detection. The UTS actor had a multi-day window inside the environment. Alert on anomalous volumes of file reads, archive creation, and outbound transfer from hosted platform storage, not just on authentication anomalies.
-
Plan remediation for scanned identity documents, not just SSNs. Where driver's licenses, government IDs, and insurance cards are exposed, credit monitoring is insufficient. Advise affected individuals to review explanation-of-benefits statements for care they did not receive, and to request medical record accountings from their providers.
Sources: UTS Breach Exposes 3.8 Million Health Records | Unlimited Technology Systems Data Breach Affects 3.8 Million Patients | Intrusion at US healthcare software provider puts 3.8M people's dat... | Health-ISAC warns of rising ShinyHunters data theft attacks on heal... | Ransomware at Ohio vendor triggers notices for 442,000 patients – M... | Unlimited Systems Data Breach Reported; Lawyers Investigating | Mary Bird Perkins Cancer Center Data Breach Lawsuit - Class Action U | Healthcare Software Breach Exposes 3.8 Million Americans' Medical D...