Skip to content
cisonews.net

Incident · State breach notice (California AG)

Stockton Cardiology data breach: suspicious emails, files taken, and some later published

Compiled from public records. Updated 2026-11-13. By the cisonews.net Desk.

The Stockton Cardiology Medical Group data breach affected 90,000 people, according to the federal health breach portal, where Stockton Cardiology Medical Group reported a hacking or IT incident as a health care provider on March 18, 2026. Stockton Cardiology Medical Group, a cardiology practice in Stockton, California, says it found suspicious emails sent to several employees on December 15, 2025. A month later it learned that files may have been taken from its systems, and by February 17, 2026 it knew some of them had been published. The federal health breach list counts 90,000 people. Patients are offered one year of credit monitoring through Epiq.

Entries like this one, in Wednesday’s docket

Wednesdays

Unsubscribe any time.

What happened at Stockton Cardiology?

The practice deleted the suspicious emails as part of its first clean-up. On January 17, 2026 it found that files kept for business and patient care may have been accessed and removed by the unauthorized individual. The letter says the files may include personal information, protected health information and some company business records.

DateWhat the letter and the regulators' records say
December 15, 2025Suspicious emails to several employees found; emails deleted
January 17, 2026Practice finds files may have been accessed and removed
February 17, 2026Practice learns some files have been published
March 9, 2026Letter date
March 18, 2026Report to HHS (90,000)
March 20, 2026Notice recorded by California

The letter does not say who published the files or where.

What information was involved?

Patient names, mailing addresses, email addresses and billing records, which may contain limited medical information about the services provided. The letter does not list Social Security numbers, insurance numbers or payment card details.

What did Stockton Cardiology change after the breach?

The letter names six steps.

  1. It hired an independent security firm to help investigate.
  2. It made several changes to the security configuration of its systems.
  3. It shut down an older remote access service its staff used.
  4. It added multi-factor authentication to some internal systems.
  5. It reset every password on every system.
  6. It is reviewing its data retention rules so that fewer working files are kept.

The guide to healthcare provider breach notices compares what other practices say they did.

What is Stockton Cardiology offering?

ItemDetail from the letter
ServiceOne year of complimentary credit monitoring
ProviderEpiq
Questions(209) 944-5750, Monday to Friday, 8 a.m. to 5 p.m., or response@stocktoncardiology.com

The letter also suggests placing a fraud alert with a credit bureau, ordering credit reports and watching bank and card statements.

What the documents leave open

  • How the suspicious emails connect to the access to the files.
  • How many files were taken, and how many were published.
  • Whether the 90,000 on the HHS list is a final count; it is a round number.

With 90,000 people, Stockton Cardiology Medical Group's report is the 50th largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.

How this disclosure's timing compares

Stockton Cardiology Medical Group disclosed 95 days after the discovery date its notice gives. Across the 206 other state breach notices on cisonews.net that date discovery to the day, the median gap is 100 days.

California's breach-notice rule

California's breach law (Civil Code § 1798.82 for businesses, § 1798.29 for state agencies) requires any person or business that must notify more than 500 California residents of a single breach to submit one sample copy of that notice to the Attorney General electronically. The California Attorney General's breach list, where this notice was found, is built from those submissions. Source: California Department of Justice, Office of the Attorney General, Data Security Breach Reporting. The guide Data breach laws by state: notice deadlines and attorney general thresholds in 23 states reads the rule in full, and the glossary defines Breach notification law.

Other health care incidents on cisonews.net

All health care incidents

Sources

  1. 2026-03-20 · AStockton Cardiology Medical Group, security breach notice filed with the California Attorney General, published March 20, 2026
  2. 2026-11-07 · ACalifornia Attorney General, data breach notification record, published November 7, 2026
  3. 2026-11-07 · AU.S. Department of Health and Human Services, Office for Civil Rights, breach portal (breaches affecting 500 or more individuals), published November 7, 2026
  4. undated · ACalifornia Department of Justice, Office of the Attorney General, Data Security Breach Reporting

Tier A: the organization itself (including notices it filed with a state attorney general), a regulator or SEC EDGAR. Tier B: established press. Each fact on this page carries its supporting passage in the page source.

Entries like this one, in Wednesday’s docket

Wednesdays

Unsubscribe any time.