MPOWERHealth data breach letter: a June 2025 network intrusion, patient files identified 16 months later

Date	Event
June 23, 2025	Start of the window in which files may have been accessed
June 26, 2025	MPOWERHealth detects the intrusion and secures its networks
October 20, 2026	Document review finds patient files were in the affected systems
November 13, 2026	Notice posted by the California attorney general

What is MPOWERHealth?

The company describes itself as a provider of data-driven solutions for neurological and musculoskeletal care. Its site lists intraoperative neuromonitoring (IONM) and models for hospitals and ambulatory surgery centers in spine, neuro and orthopedic care. The letter is signed from 5080 Spectrum Dr., Suite 1100E, Addison, Texas. The letter does not say which hospitals or patients' procedures the files came from. Why you got a breach letter from a company you never dealt with explains the pattern.

What information was involved?

The letter names the person's full name and leaves the rest as a field filled in per letter. It says the files held personally identifiable information and protected health information. It does not say whether Social Security numbers, insurance numbers or diagnoses were among them; your own letter lists what applies to you.

Has the medical information been misused?

MPOWERHealth says it has no evidence that the medical information was or will be used for unintended purposes. It recommends reading the explanation of benefits statements from your health insurer and following up on any service you do not recognize. It also suggests asking your insurer for a year-to-date report of all services paid for you.

Why did the notice take 16 months?

The letter puts the gap down to an extensive forensic investigation and a manual document review, carried out with outside cybersecurity professionals, that ended on October 20, 2026. The letter gives October 20, 2026 as the date it learned whose files were involved, and does not explain why the review took that long. Healthcare provider breach notices, the largest 2026 health breaches reported to HHS and the health care sector page set this against other health notices in the log.

What is MPOWERHealth offering?

Identity monitoring from Kroll at no cost, with single-bureau credit monitoring, fraud consultation and identity theft restoration. The sample letter leaves the number of months and the activation deadline blank. Activation is at enroll.krollmonitoring.com with the membership number on the letter. Questions go to the response line at (844) 301-0181, 9:00 am to 6:30 pm Eastern, Monday through Friday. Credit monitoring offers in breach letters compares Kroll offers with the others in the log.