Nephrology Associates experienced a network security incident involving unauthorized access between January 17, 2026, and April 9, 2026. The medical practice detected suspicious activity on April 9, 2026, and later reported the incident to the U.S. Department of Health and Human Services on July 29, 2026, followed by a report to the Vermont Attorney General in November 2026.
The compromised records included patient names, Social Security numbers, dates of birth, driver's license numbers, and other government identification numbers. Health information such as treatment and diagnosis details, health insurance policy data, financial account codes, and credit or debit card information were also exposed. Nephrology Associates reported that 24,088 individuals were affected, and written breach notices were mailed starting around July 30, 2026.
Investigations into healthcare cybersecurity incidents often take time to establish complete scopes of compromised data. Additional details regarding the incident and regulatory findings may develop as oversight agencies review the reported filings.