Informal cybersecurity reports indicated a ransomware attack by the incransom group on Colorado Rehabilitation and Occupational Medicine (CROM) as of July 2, 2026. These reports suggest the incident was discovered on this date.
As of now, no official breach notification letter has been issued by CROM, nor has the company released an official statement. The number of affected individuals, specific data types exposed (such as SSN, medical records, or financial data), and the states affected remain unconfirmed. There are no records of state Attorney General filings, class-action lawsuits, or multidistrict litigation related to this incident at this time.
Details about this potential breach may emerge in the future, and official notices can be delayed.