Western Orthopaedics data breach: September 2025 access, with card numbers and security codes

What happened at Western Orthopaedics?

The practice says it moved to investigate, contain and fix the incident with its contracted cybersecurity team and outside experts. Its analysis of whether personal and health information was in the affected data ended on March 3, 2026.

Date	What the letter and the regulators' records say
About September 17 to 25, 2025	Third party accesses or takes data in the network
October 2, 2025	Practice becomes aware of a possible incident
March 3, 2026	Analysis of the affected data ends
May 1, 2026	Report to HHS (113,330); logged in Massachusetts (46 residents)

The access ran for about eight days and ended a week before the practice became aware of it. The report to HHS came about seven months later.

What information was involved?

The letter lists full name and address, phone number, Social Security number, date of birth, and financial account, credit or debit card number, with or without any security code, access code or password. It also lists health insurance information, plan or subscriber ID, provider name, dates of service, and medical cost or billing information. Not every element applies to every person. For the 46 Massachusetts residents in Western Orthopaedics' notice, the state's record marks Social Security numbers and medical records as breached, but not financial accounts or card numbers.

What is Western Orthopaedics offering?

Item	Detail from the letter
Service	Credit monitoring and identity protection, for the number of months printed on each letter
Provider	Epiq
Questions	855-815-3938, 8:00 a.m. to 8:00 p.m. Central Time, Monday to Friday

The practice says it has no indication of identity theft or fraud tied to the event. The guide to payment card breach notices covers what card data in a letter means, and the guide to credit monitoring offers compares services.

What Texas's attorney general recorded

Texas's attorney general lists a report from Western Orthopaedics, P.C., posted on May 5, 2026, with 363 Texans affected, a count of Texas residents only. The record lists names, addresses, Social Security numbers, medical information, health insurance information and dates of birth as involved.

What the documents leave open

• How the third party got in.
• How many people had card or account numbers in the data.
• How long the monitoring lasts; the sample leaves the months blank.

With 113,330 people, Western Orthopaedics' report is the 46th largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.