Arkansas Primary Care Clinic Breach (2025): Patient SSN & Home Address Exposed

About Arkansas Primary Care

Arkansas Primary Care Clinic, PA is a primary-care medical practice based in Little Rock, Arkansas, providing routine and family medical services to patients across central Arkansas. The clinic operates as a roughly 30-employee independent practice with approximately $6.8 million in annual revenue, typical of a regional primary-care operation. Services include general primary care, preventive medicine, routine examinations, and management of common chronic conditions. As a HIPAA-regulated primary-care provider, Arkansas Primary Care maintains patient identity, contact, insurance, billing, appointment, and clinical records across its routine medical-service workflows, alongside diagnosis, treatment, and prescription information typical of a primary-care relationship that often spans many years.

Why They Hold Your Data

Primary care clinic networks collect patient identity, contact, insurance, billing, appointment, and clinical records across routine medical-service workflows.

Recent Developments

Arkansas Primary Care was attacked by the INC Ransom ransomware group in late April 2025. The attackers claimed to have exfiltrated approximately 15 GB of data before deploying ransomware on the clinic's systems and subsequently listed the practice on the INC Ransom dark-web leak site. The breach was indexed by breach-tracking services in early July 2025. Class-action investigations by U.S. plaintiff law firms began organizing in mid-2025 following the initial disclosure. INC Ransom has been an active ransomware-as-a-service operation throughout 2024 and 2025 with multiple healthcare-sector victims, including Mount Rogers Community Services Board.

Data Points Exposed

Breach Impact

The institutional impact on Arkansas Primary Care is significant relative to the practice's size as a small regional primary-care clinic. Federal HIPAA notification obligations, an Office for Civil Rights review, Arkansas attorney-general filings, and emerging class-action litigation discussions are all underway. INC Ransom's listing of the practice and threatened publication of the stolen 15 GB dataset creates direct evidence of broad data exposure. As a small independent practice with limited cybersecurity budget and staffing, Arkansas Primary Care faces operational and financial challenges in remediation and litigation that are typical of small healthcare providers. The reputational impact is concentrated within the Little Rock primary-care market, where the breach may affect patient retention.

Exploitation & Downstream Threats

• Identity theft and synthetic identity construction using government-issued IDs | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure

What You Should Do

1. Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
2. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
3. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
4. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).