Unlimited Technology Systems breach: practice management software data copied in October 2025

What happened in the Unlimited Technology Systems breach?

Unlimited says it discovered unauthorized activity in its commercial datacenter on October 19, 2025. It hired a cybersecurity forensic firm, notified law enforcement and reviewed the data involved. The letter describes the company as a provider of practice management software to health care organizations and providers, which is why patients hear from a firm they may never have heard of.

Date	What the letter and the regulators' records say
October 5 to 10, 2025	The unauthorized actor copies data; October 5 is the breach date on the California, Washington and Indiana records
October 19, 2025	Unlimited discovers the activity in its datacenter
July 21, 2026	Report submitted to HHS; notice recorded by California and Washington; Indiana's report gives this as the date notice was sent
July 22, 2026	Report logged in Massachusetts
July 23, 2026	Posted on the Texas attorney general's list

275 days passed between the discovery and the first regulator records. The notice delay study shows how that compares with other notices.

What information was involved?

The letter says the data may have included each person's name and one or more of these: health insurance and patient balance information, medical information such as medical record numbers, dates of service and diagnoses, scanned documents such as driver's licenses, other government IDs, insurance cards and intake forms, Social Security numbers, and other details such as date of birth, email, address and phone number. It says the types differ from person to person.

Unlimited says the data did not include full patient medical records, medical imaging or financial information such as credit card or bank account numbers. The state records agree on Social Security numbers and driver's licenses: Washington, Texas and Massachusetts all list them, and Massachusetts marks financial accounts and payment cards as not breached.

How many people were affected?

Regulator	What it counts	Number
HHS Office for Civil Rights	Individuals affected	3,803,750
Indiana attorney general	Total affected, as reported to Indiana	3,836,316
Indiana attorney general	Indiana residents	28,384
Texas attorney general	Texans	277,364
Massachusetts consumer affairs office	Massachusetts residents	2,223
Washington attorney general	Washingtonians	724

Indiana's total is 32,566 higher than the federal figure; neither record says why. The report ranks among the largest in the national ranking from Indiana's report and the Texas ranking.

What is Unlimited offering people who got a letter?

Unlimited is paying for two years of Kroll identity monitoring, with credit monitoring, fraud consultation and identity theft restoration.

Item	Detail from the letter
Provider	Kroll
Length	Two years, at no cost
Enrollment	Enroll.krollmonitoring.com/redeem, with the activation code and verification ID on the letter
Deadline	Printed on each letter (blank in the filed copy); the code stops working after it
Phone	(844) 576-3063, Monday to Friday, 9:00 a.m. to 6:30 p.m. Eastern Time, excluding major U.S. holidays

The letter says Unlimited added security measures after the incident but does not describe them. The credit monitoring offers guide compares other offers, and the guide to letters from companies you never dealt with explains why a software vendor writes to patients.

What the documents leave open

• How the unauthorized actor got into the datacenter, and whether ransomware was involved.
• Which health care organizations' patients are affected; the letter does not name Unlimited's customers.
• Why the federal and Indiana totals differ by 32,566.

Why did I get a letter from Unlimited Technology Systems?

Your doctor's office or another health care organization used Unlimited's practice management software, and your information was in the data copied from Unlimited's datacenter. The letter does not name the organization.

Was my Social Security number exposed in the Unlimited Technology Systems breach?

Possibly. Social Security numbers are one of the categories the letter lists, and the state records include them, but the letter says the information involved differs from person to person. Your own letter lists what applies to you.