February–August 2026: the Connecticut orthopaedic group Comprehensive Orthopaedics & Musculoskeletal Care identified suspicious network activity on February 12, 2026, reviewed the affected files and posted a notice of a data breach in August. A federal HHS report lists 21,897 individuals. Canonical: comprehensive-orthopaedics-ct2026. Reporting: Hartford Business.
Comprehensive Orthopaedics is a privately owned practice with several Connecticut locations, including Wallingford and Southington. Orthopaedic practices hold health and insurance records, but the sources reviewed for this entry do not list the data types involved in this incident.
What happened
- February 12, 2026: the practice identified suspicious activity on its network.
- Afterward: it reviewed the affected files to identify the people whose information was involved.
- August 2026: the practice posted a public notice. Hartford Business dates it to August 14.
- September 2026: the breach was reported to HHS’s Office for Civil Rights. Becker’s cites a September 10 report. The sources differ on the filing date.
Verified and unverified
- Practice notice (as reported): suspicious network activity was identified on February 12, 2026, and letters are being sent to potentially affected people.
- HHS filing: 21,897 individuals.
- Not published in the sources reviewed: the intrusion method, the data types, whether any data was misused, and whether a group claimed the attack.
- Solicitations, not lawsuits: law firms are inviting affected people to join possible class actions. These are advertisements, not confirmed filings.
Who is at risk
Patients whose information was in the affected files. For health records, the main concern is medical identity theft, where someone uses a victim’s name or insurance to obtain care or prescriptions. It can take months to notice. Financial fraud is a risk if payment or identity data was involved.
What to do
- Read the notice letter and follow its instructions, including any deadline to enrol in credit monitoring.
- Check explanation-of-benefits statements from your insurer for care you did not receive.
- Request a copy of your medical record from the practice and check it for entries you do not recognise.
- Consider a credit freeze with the three major US credit bureaus if the letter says identity data was involved.
- Ignore unsolicited legal offers that ask for payment or personal details, and confirm any notice with the practice directly.
Reference links
- Hartford Business: Connecticut orthopedic practice reports data breach affecting nearly 22,000 people
- Becker’s Spine: Connecticut orthopedic group data breach impacts 21,000+ patients
- ClaimDepot: Comprehensive Orthopaedics data breach
Sourcing note: the practice’s own notice was not retrieved. Figures and dates come from news and aggregator reports that cite the HHS filing, and some dates conflict across those sources.
Related reading
- UltraMobile Imaging: patient records breach affecting 75,000 people, another 2026 healthcare breach
- NorthShore Health Centers, a recent October 2026 health-provider breach