2026 Suntree Internal Medicine — network intrusion; 9,810 patients (HHS OCR); INC Ransom claimed Oct 1
Data compromised
Per practice notice: names, addresses, medical treatment information, and health insurance information for some patients (varies by individual). SSNs, payment cards, and bank accounts not involved per the clinic. HHS OCR census 9,810 individuals.
Technical writeup
Verified clinic notice plus HHS OCR census — June 2026 reporting window. Suntree Internal Medicine (Melbourne, Florida) identified unusual activity on 28 September 2025, secured the network, and investigated with specialists. The review found certain files may have been accessed or acquired without authorization. The practice says there is no evidence of misuse or attempted misuse as of its website notice. Exposed data types may include name, address, medical treatment information, and health insurance information; SSNs, credit-card, and bank-account data were not involved per the clinic. HHS OCR lists 9,810 individuals (reported 18 June 2026). On 1 October 2025 INC Ransom publicly claimed the attack on Tor, per August 2026 trade summaries citing the actor listing — treat actor narrative as supplemental to the clinic attestation. Dedicated call center 833-851-4841. recordsAffected 9810 from HHS OCR.
Root cause
Unauthorized access to a portion of the practice network discovered 28 September 2025; INC Ransom publicly claimed responsibility 1 October 2025 (trade press)