Unlimited Technology Systems Breach Exposes Data of Nearly 4 Million Individuals
Unlimited Technology Systems has reported a significant data breach affecting 3.8 million individuals, with attackers accessing sensitive personal, medical, and health insurance information.
Unlimited Technology Systems, a provider of financial and revenue cycle technology to healthcare providers, has disclosed a data breach that impacted approximately 3.8 million individuals. The company, which serves thousands of oncology and specialty providers, discovered the incident in October 2025.
The breach involved unauthorized access to one of Unlimited's commercial data centers, where attackers exfiltrated sensitive data between October 5 and October 10, 2025. The compromised information includes names, addresses, phone numbers, email addresses, Social Security numbers, medical record numbers, diagnoses, dates of service, and insurance policy details. Scanned documents, such as driver's licenses and government IDs, were also stolen.
While the breach exposed a wide range of personal and medical-related data, Unlimited stated that full patient medical records, medical imaging, or financial information like credit card or bank account details were not compromised. The company also reported that it is not currently aware of any misuse of the stolen information.
The US Department of Health and Human Services (HHS) was notified of the breach in late July, with Unlimited adding the incident to the HHS breach portal on August 6. The scale of the incident, affecting 3,803,750 individuals, places it among the larger healthcare-related data breaches.
In response to the incident, Unlimited Technology Systems is offering affected individuals two years of complimentary credit monitoring, fraud consultation, and identity theft restoration services. These services aim to help mitigate potential harm from the exposure of personal information.
Details regarding the threat actor responsible for the attack have not been disclosed by Unlimited, nor have any known cybercriminal groups claimed responsibility for the breach. The investigation into the full scope and nature of the compromise is ongoing.
This incident underscores the persistent threats faced by healthcare technology providers, which handle vast amounts of sensitive patient data. The exfiltration of medical and insurance information can lead to identity theft, insurance fraud, and other malicious activities, even if full financial details are not compromised.
Organizations like Unlimited Technology Systems are critical infrastructure within the healthcare ecosystem, making their security posture paramount. The breach serves as a stark reminder of the need for robust data protection measures and continuous vigilance against evolving cyber threats.