Hematology Oncology Consultants data breach: a September 2025 attack, letters in April 2026

What happened at Hematology Oncology Consultants?

HOC says it secured its systems and investigated with cyber specialists, then reviewed the data to find the people and information involved. It finished finding up-to-date addresses on April 7, 2026.

Date	What the letter and the regulators' records say
On or about September 20, 2025	Cyberattack on HOC's network
On or about February 12, 2026	HOC learns files were likely taken, and whose information they held
April 7, 2026	Address search finished
April 24, 2026	Letter date; report to HHS (62,972)
May 1, 2026	Logged in Massachusetts (16 residents)

The letter says nothing about the five months between the attack and February 12. It does not say when HOC first noticed the attack, only when it learned that files were likely taken.

What information was involved?

Each letter lists the reader's name and their own items; the sample leaves the list blank. For the 16 Massachusetts residents in Hematology Oncology Consultants' notice, the state's record marks Social Security numbers and medical records as breached. HOC says it has added measures to harden its environment.

What does the letter offer?

The sample sends readers to its own list of protective steps, such as credit reports, fraud alerts and security freezes, and describes no monitoring service.

Item	Detail from the letter
Credit monitoring	None described in the sample
Questions	855-954-9214, 8:00 a.m. to 8:00 p.m. Eastern Time, Monday to Friday, excluding holidays

The guide to credit monitoring offers sets Hematology Oncology Consultants' offer beside other letters.

Was Hematology Oncology Consultants hit by ransomware?

The practice's letter calls it a cyberattack and does not use the word ransomware. HIPAA Journal reports that the Rhysida ransomware group claimed the attack, says it has sold some of the stolen data, and has leaked 40% of what it took. The claims are the group's own and are not confirmed in the practice's letter.

What information was involved in the Hematology Oncology Consultants breach?

HIPAA Journal, reporting on the notice, lists names, medical records, health insurance information and Social Security numbers. That matches the Massachusetts record, which marks Social Security numbers and medical records as breached.

How many people were affected by the Hematology Oncology Consultants breach?

62,972 people, the number the practice gave the federal health privacy office on April 24, 2026. When HIPAA Journal wrote about the notice, the count was not yet public.

Record	What it counts	Number
HHS Office for Civil Rights	People affected	62,972
Massachusetts consumer affairs office	Massachusetts residents	16

From the attack to the letters took 216 days, about seven months, and the practice learned that files were likely taken almost five months after the attack. The notice-delay guide shows how other practices compare.

Was my information in the Hematology Oncology Consultants data breach?

If you got a letter from Hematology Oncology Consultants in Farmington Hills, Michigan dated April 24, 2026, your information was in the files. The sample letter describes no credit monitoring, so the steps it lists are the ones to take yourself: a credit freeze or fraud alert with the three bureaus, and a check of insurance statements for care you did not receive.

What the documents leave open

• When HOC first detected the September 2025 attack.
• What kind of attack it was.

With 62,972 people, Hematology Oncology Consultants' report is the 68th largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.