3C Care Systems was identified as the third-party vendor involved in a ransomware-related data breach affecting Midwest Spine and Brain Institute. Midwest Spine and Brain Institute determined on June 18, 2026, that systems containing personal and protected health information had been accessed on or around November 21, 2024. The incident was publicly reported in August 2026, and a related notification was submitted to the Massachusetts Office of Consumer Affairs and Business Regulation on August 14, 2026. Reports attributed the attack to RansomHub, which claimed to have obtained 100 GB of data.
Reportedly exposed information included names, dates of birth, Social Security numbers, medical records, treatment and procedure information, diagnoses, medical record numbers, and medical provider information. The available reports do not state the number of individuals affected through 3C Care Systems. Midwest Spine and Brain Institute operates 13 locations in Minnesota and Wisconsin, and further details about the vendor-side incident may emerge as notices and investigations continue.