2026 Heritage Pediatrics — phished employee email account; patient information possibly accessed (2,876 Texas residents)
Data compromised
Varies by person, per a law-firm summary of the notice: names with Social Security numbers, birth dates, ID or passport numbers, financial details, insurance information, and clinical data such as diagnoses and procedure codes. The practice reported no misuse at the time of notice.
Technical writeup
Letters went out by U.S. mail around October 19, 2026, with a website notice and a toll-free line. The practice reported the incident to the Texas Attorney General on October 20, 2026, listing 2,876 affected Texas residents; the total across all states has not been published. The incident date (around April 12–13, 2026) comes from a secondary listing. The practice’s location and website could not be confirmed, so the company row has no link. Confirm the filing on the Texas AG portal. recordsAffected 2876 is the Texas figure only.
Root cause
Fraudulent messages were sent from one employee’s email account, which was then compromised. Outside cybersecurity specialists confirmed that a single email account had been compromised, and the account was secured.