October 19, 2026: Heritage Pediatrics began notifying patients that fraudulent messages had been sent from an employee's email account after that account was compromised, and that patient information in the account may have been accessed. The practice reported the incident to the Texas Attorney General on October 20, listing 2,876 affected Texas residents. Canonical: heritage-pediatrics-email2026. Primary source: the Texas Attorney General's data breach report portal, where the filing should be checked directly.
Sourcing note: this is a thin-sourced entry. The practice's location and website could not be confirmed, the notice letter itself was not retrieved, and the incident date comes from a secondary listing. The details below rely on a law-firm summary of the notice and on the Texas filing. Treat them as provisional until the notice or the regulator's entry is checked.
What happened
- Around April 12–13, 2026: the incident date, according to a secondary listing that is not independently confirmed.
- Around October 19, 2026: letters went out by U.S. mail. The notice also appeared on a website and a toll-free line was provided.
- October 20, 2026: the practice reported the incident to the Texas Attorney General.
The practice says the attacker used a phishing message to compromise one employee's email account. Outside cybersecurity specialists confirmed that a single account had been compromised and that the account had been secured.
What data may have been exposed
Per a law-firm summary of the notice, the data varies by person. It may include:
- Names, with Social Security numbers, dates of birth, and ID or passport numbers
- Financial details and insurance information
- Clinical data such as diagnoses and procedure codes
The practice reported no misuse at the time of the notice.
Scope
The Texas filing lists 2,876 Texas residents. The total across all states has not been published. The catalog records 2,876 as the Texas figure only, so the overall number is likely to be higher and is not known. Patients outside Texas may also have received a letter, so anyone who was a patient of the practice should check the notice.
Verified vs unverified
- Verified (practice notice and Texas filing, as reported): the phishing-driven compromise of one employee email account, the October 2026 letters, the October 20 report to the Texas AG, and the 2,876 Texas residents.
- Reported by a secondary source only: the April 2026 incident date, and the list of data types.
- Not known: the practice's location, the total number affected across all states, whether any data has been misused, and what the phishing message contained.
Who is at risk
Patients of the practice are in scope, and the risk is higher for children's records that include a Social Security number. Parents and guardians who gave the practice identity or insurance details for a child should pay particular attention, because a child's identity can be misused for years before anyone notices.
What to do
- Read the notice letter and use only the phone number and address it gives. Do not use numbers from unexpected messages.
- For a child whose Social Security number may be involved, consider a credit freeze or a credit report check for the child. Your state's consumer protection office or the national credit bureaus can explain how.
- Review insurance statements for visits or services that did not happen, and report anything unfamiliar to your insurer and to the practice.
- Be suspicious of calls that claim to be from the practice and ask for personal details or payment. Hang up and call the number you already have, and ask the practice to confirm any request by that number.
- Check the Texas Attorney General's portal for the official entry, which will show the most current figures.
- Keep the notice letter. It contains the reference details you may need if you contact the practice or a credit bureau.
Why children's records need extra attention
Records for minors are a particular concern. A child usually has no credit history to check against, so misuse of a child's Social Security number can go unnoticed for years. The law-firm summary lists Social Security numbers among the possible data types, but it does not say how many of the 2,876 Texas residents are children. Parents should not assume a child's record is safe because the practice has not mentioned it.
What thin sourcing means for readers
Because the notice letter was not retrieved, this article cannot say what data each patient received, whether a credit monitoring offer was made, or whether the practice has filed in other states. Readers should treat the figures as the Texas filing reports them. This account should be replaced once the notice or the regulator's entry has been checked directly.
Related reading
For another health breach where patient records were exposed through a single compromised access point, see CareCloud's patient-records breach. For a hospital case with a similar pattern, see the Madera Community Hospital breach.