Data Breach WatchDBW

Healthcare

High

investigation open

Updated about 1 month ago

Orthopaedic Institute of Western Kentucky Data Breach

▼ Key takeaways

•Reports suggest a potential breach involving Orthopaedic Institute of Western Kentucky.
•Discovered on December 15, 2025.
•Possible data exposed: Names, Addresses, Dates of Birth, Medical Information, Health Insurance Information, Social Security Numbers.
•Affects individuals in: Kentucky, Tennessee, Illinois, Missouri, Indiana.
•Confirmation level: Confirmed by regulators.

Breach confirmed

The Orthopaedic Institute of Western Kentucky breach is confirmed. If you may be affected, add your details below and we will take it from there.

Detailed summary

The Orthopaedic Institute of Western Kentucky (OIWK) experienced a data breach that was initially detected on December 15, 2025, due to a ransomware attack on its IT systems. The breach was publicly disclosed in early 2026 with notifications to affected individuals beginning in February 2026. Official sources include the HHS Office for Civil Rights (OCR) Breach Portal, the Kentucky AG Data Breach Portal, and OIWK's website notice.

Approximately 47,000 individuals were affected by this incident. The types of data exposed include names, addresses, dates of birth, medical information (such as treatment records and diagnoses), health insurance information, and Social Security numbers for a subset of the victims. No financial account numbers were reported as compromised. The states primarily affected were Kentucky, with smaller numbers in Tennessee, Illinois, Missouri, and Indiana.

Details about data breaches can emerge over time, and notification processes may experience delays.

Data possibly involved

Names
Addresses
Could be combined with other data for identity theft
Dates of Birth
Medical Information
Health Insurance Information
Could be used for insurance fraud
Social Security Numbers
Can be used to open fraudulent accounts and file false tax returns

Company Response Timeline

Response Grade

Notified consumers within 61–90 days

Breach Occurred

Dec 15, 2025

Company Discovered

Dec 15, 2025

Regulator Notified

Feb 10, 2026

Consumers Notified

Feb 15, 2026

0 days to discover

62 days to notify consumers

Breach Verification Status

Reports Only

Complete

Initial dark web reports of potential breach

Company Confirmed

Complete

Company has acknowledged the breach

Regulator Confirmed

Current

Confirmed by regulatory authorities

Note: Breach verification can take time. Information may evolve as more details become available from companies and regulators.

Case Status:

Investigation Open

We're actively investigating this case and seeking affected individuals.

Were you affected? Submit your information below.

Were You Affected By This Breach?

If you are a customer or have received a data breach notification, you may submit your information as part of our ongoing investigation. Submitting your information is free and does not obligate you.

Were you in the Orthopaedic Institute of Western Kentucky breach? Check your email

Free scan against known breach datasets. Then remove your info from data-broker sites with Data Shield.

No signup required. 30-second scan. Your email is only stored if you opt into alerts.

Get your info off data-broker sites

Data Shield files removal requests with every broker that accepts an authorized agent, and gives you the exact link or letter for the brokers that only accept requests from you.

See how Data Shield works

Check Your Risk Level

Answer a few questions to understand how this breach might affect you

Do you use Orthopaedic Institute of Western Kentucky?

Yes

What state are you in?

What should I do?

Change your passwords

Update passwords for the affected service and any accounts using the same password

Enable two-factor authentication

Add an extra layer of security to your accounts

Monitor your accounts

Watch for suspicious activity on your financial and online accounts

Watch for phishing attempts

Be cautious of emails or messages claiming to be from the affected company

Consider a credit freeze

Prevent unauthorized access to your credit report

Scan your email for other exposures

Check whether this address shows up in other known breaches. Free, no account.

Get your info off data-broker sites

Data Shield files removal requests with every broker that accepts an authorized agent, and gives you the exact link or letter for the brokers that only accept requests from you.

See how Data Shield works