Atlantic Digestive Specialists data breach: two days in March 2026, letters in September

What happened at Atlantic Digestive Specialists?

The practice says it secured its network, opened an investigation and brought in cybersecurity experts. Its review of the affected data ended in August 2026. It then spent until September 8 finding contact details, and dated its letters September 30.

Date	What the letter and the regulators' records say
March 16 to 17, 2026	Information may have been viewed or acquired
March 20, 2026	Practice alerted to suspicious activity
August 2026	Review of the affected data ends
September 8, 2026	Contact details located; notification arranged
September 30, 2026	Letter date; report to HHS (173,853)
October 1, 2026	Logged in Massachusetts (1,489 residents)

The letters went out about six and a half months after the activity. The guide to how long companies take to notify shows where that falls.

What information was involved?

Atlantic Digestive Specialists' sample letter leaves the data items as a placeholder. For the 1,489 Massachusetts residents in Atlantic Digestive Specialists' notice, the state's record marks Social Security numbers and driver's licenses as breached, and not medical records, financial accounts or card numbers. The practice says it has no evidence of any actual or attempted misuse.

What information was exposed in the Atlantic Digestive breach?

Far more than the Massachusetts record shows. The practice's own press release of September 30, 2026 lists what may have been involved for patients across the whole incident, and it runs from identity numbers to clinical detail and login credentials. Each person's letter names their own items.

Kind of data	Items the release lists
Identity	Name, Social Security number, driver's license or state ID number, date of birth, alien registration number, taxpayer identification number, passport number
Money	Financial account information, payment card information, medical cost
Clinical	Clinical information, diagnosis, medical history, medical record number, treatment or procedure information, mental or physical condition, prescription information, dates of service, provider name
Insurance and billing	Medicaid or Medicare number, health insurance policy number, patient account number
Access	Username and password information, digital or electronic signature

Because usernames and passwords are on the list, anyone who used the same password on other accounts may want to change it there too. The release says notices to patients began on September 30, 2026, after the practice finished locating contact details on September 8.

What does the practice say it did, and what does it offer?

It says it reviewed its systems, strengthened network security and added security measures. The sample letter filed with Massachusetts does not describe a credit monitoring offer. It sets out steps readers can take themselves: checking statements and credit reports, and reporting suspected identity theft.

Item	Detail from the letter
Questions	1-866-200-0962, Monday to Friday, 9:00 a.m. to 9:00 p.m. Eastern Time, excluding U.S. holidays

What the documents leave open

• How the intruder got in, and whether the data was taken or only viewed.
• Why so many Massachusetts residents were among the people affected.
• Whether the 173,853 includes people whose payment card or login details were involved, and how many.

With 173,853 people, Atlantic Digestive Specialists' report is the 31st largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.