Tri-Cities Gastroenterology data breach: files removed in December 2025

What happened at Tri-Cities Gastroenterology?

The practice says it contained the threat and investigated with outside cybersecurity professionals. On or about April 22, 2026, it determined that the files removed by an unauthorized third-party actor held patients' personal information. The letter says the files were removed, not that they may have been.

Date	What the letter and the regulators' records say
On or about December 11, 2025	Unauthorized access; files removed
On or about April 22, 2026	Practice finds personal information in the removed files
April 29, 2026	Report to HHS (67,115); Indiana notice (26 residents); logged in Massachusetts (4 residents)

The report to HHS and the Indiana notice came a week after the finding, and about four and a half months after the incident.

What information was involved?

Tri-Cities Gastroenterology's sample letter names the reader and leaves the other data items blank. For the 4 Massachusetts residents in Tri-Cities Gastroenterology's notice, the state's record marks Social Security numbers and medical records as breached. The practice says it has no evidence of fraud or identity theft resulting directly from the incident.

What is Tri-Cities Gastroenterology offering?

Item	Detail from the letter
Service	Experian IdentityWorks, for the number of months printed on each letter
Questions	A toll-free line printed on each letter, Monday to Friday, 9:00 a.m. to 9:00 p.m. Eastern time

The guide to credit monitoring offers sets Tri-Cities Gastroenterology's offer beside other letters, and the guide to healthcare provider breach notices compares other practices' letters.

Was Tri-Cities Gastroenterology hit by ransomware?

HIPAA Journal reports that the Insomnia threat group claimed the attack, listed the practice on its dark web leak site in December and then leaked the stolen data, which it reads as a sign the ransom was not paid. The practice's own letter does not use the word ransomware, name a group or mention a demand. If the report is right, the files have been published, which is one of the questions the letter leaves open.

What information was involved in the Tri-Cities breach?

HIPAA Journal, reporting on the notice, lists full names, Social Security numbers, dates of birth, addresses, email addresses, telephone numbers, gender and medical record numbers. That matches the Massachusetts record, which marks Social Security numbers and medical records as breached. The same report describes the practice as having five locations in Tennessee.

How many people were affected by the Tri-Cities Gastroenterology breach?

67,115 people. The federal health privacy office and Indiana's attorney general give the same total.

Record	What it counts	Number
HHS Office for Civil Rights	People affected	67,115
Indiana attorney general	People affected in total	67,115
Indiana attorney general	Indiana residents	26
Massachusetts consumer affairs office	Massachusetts residents	4

The ranking of Indiana's 2026 report lists it among the entries in this log.

Was my information in the Tri-Cities Gastroenterology data breach?

If you got a letter from Tri-Cities Gastroenterology dated around April 29, 2026, your information was in the removed files. Because the leak-site report says the data was published, the steps in the letter matter more than usual: enroll in the Experian service, place a fraud alert or credit freeze, and watch for mail or calls that use your medical record number. The guide to credit monitoring offers explains what a freeze adds to monitoring.

What the documents leave open

• How the unauthorized party got in.
• How many files were removed; the practice has not confirmed the leak HIPAA Journal reports.

With 67,115 people, Tri-Cities Gastroenterology's report is the 65th largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.