Freedman HealthCare, a Massachusetts-based health data consulting firm, suffered a breach after the extortion group WorldLeaks (formerly known as Hunters International) infiltrated a single file server in late April 2025. When Freedman declined to pay the ransom, WorldLeaks published the stolen files on its dark web leak site. The group claims to have exfiltrated 52.4 gigabytes of data spanning more than 42,000 files. Because Freedman designs and manages health data infrastructure for state agencies and insurers across California, Delaware, Massachusetts, and other states, affected individuals may never have heard of the company despite it holding their personal information. The exposed data includes names, home addresses, email addresses, phone numbers, and Social Security numbers for approximately 4 million people. Researchers reviewing the leaked files also found plaintext login credentials to state client accounts, raising concern about potential downstream access to public health data systems. Although the company's CEO stated that no protected health information or all-payer claims data was compromised, the presence of Social Security numbers at this scale creates serious exposure for identity theft, medical fraud, and provider impersonation. Freedman notified affected individuals under Massachusetts breach notification law, engaged outside cybersecurity experts, and reported the incident to law enforcement. A law firm announced a breach investigation in June 2025, and the company faces the prospect of class-action litigation. Anyone whose information was exposed should monitor their credit reports, consider placing a credit freeze, and watch for signs of fraudulent activity using their Social Security number.

Healthcare consulting and analytics firms collect client, provider, patient, claims, and program data across advisory, policy, and healthcare data-analysis workflows.

Freedman HealthCare operates as a specialized boutique consultancy in the public health data infrastructure space. No major organizational changes have been publicly reported beyond the 2025 breach and its aftermath.