Ransomware attack on Unlimited Technology Systems exposes 3.8 million patient records

Ohio-based medical software maker Unlimited Technology Systems has disclosed a massive ransomware breach affecting 3,803,750 patients, making it one of the largest healthcare data breaches reported in 2026. Hackers accessed the company's commercial datacenter in October 2025, potentially copying Social Security numbers, diagnoses, and insurance details. The incident underscores a dangerous industry trend where attackers target third-party billing vendors to compromise millions of records at once.

Unlimited Technology Systems ransomware breach

• ▪Ohio-based medical software maker Unlimited Technology Systems detected an unauthorized actor accessing its commercial datacenter between October 5 and October 10, 2025.
• ▪Unlimited Technology Systems, which processes billing for over 4,500 oncology practices and 6,500 specialty providers, began mailing notification letters to affected patients in July 2026.
• ▪Unlimited Technology Systems confirmed that the security incident at its commercial datacenter was a ransomware attack, though no group has claimed responsibility.

Exposed patient data scope

• ▪The files potentially copied from Unlimited Technology Systems contained names, Social Security numbers, dates of birth, diagnoses, insurance policy numbers, and scanned government IDs.
• ▪Unlimited Technology Systems stated that the compromised files did not contain complete medical records, medical images, credit card numbers, or bank account details.
• ▪According to the US Department of Health and Human Services' breach portal, the Unlimited Technology Systems ransomware incident affected the protected health information of 3,803,750 people.

Third-party vendor breach trend

• ▪Third-party vendors that process claims, billing, and records on behalf of healthcare providers accounted for six of the ten largest healthcare data breaches in 2026.
• ▪The Unlimited Technology Systems incident represents one of the largest healthcare data breaches reported to the US Department of Health and Human Services in 2026, alongside breaches at Conduent Business Services and TriZetto Provider Solutions.

Healthcare ransomware attack surge

• ▪In July 2026, hackers claimed to have stolen nearly a terabyte of file data from Craneware Group, another medical billing software vendor.
• ▪Ransomware attacks on healthcare companies rose 46% in July 2026 alone, and attacks on healthcare providers increased 20% year-over-date compared to the same period in 2025, according to tracking by Comparitech.

Regulatory oversight proposals

• ▪The US Department of Health and Human Services has proposed tightening the HIPAA Security Rule's requirements for vendor oversight in response to the rise in third-party healthcare breaches.
• ▪Unlimited Technology Systems notified law enforcement and filed a formal breach notification letter with the Iowa attorney general's office regarding the October 2025 intrusion.

2 sources