Doctor Alliance 2025 Data Breach
Healthcare Technology Company · Clinical documentation, billing, and physician workflow services · Healthcare document and billing platform · USA
Doctor Alliance Healthcare Billing Platform Breach (2025): 387K Patient SSN & Contact Records Exposed
Healthcare billing and collections management company.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
65/100
Lower riskHigher risk
High and current: recent, valuable data circulating on the dark web now.
Data Sensitivity i
ElevatedExposed data raises the risk of fraud, targeting, and impersonation. Proactive steps are warranted.
387KRecords
2025Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Crucial data exposed
SSNSocial Security Number
Breach Summary
Doctor Alliance, a Dallas-based healthcare technology company providing clinical document management and billing services to home health agencies and physician practices, suffered a credential-abuse data breach between October 31 and November 17, 2025. An unauthorized party obtained Doctor Alliance web-portal login credentials through unknown means and used a script to systematically request patient documents from the portal by enumerating combinations of patient IDs and document numbers. A hacker using the alias 'Kazu' claimed responsibility on a hacking forum on November 7, 2025, asserting theft of 1.24 million files totaling 353 gigabytes and demanding a $200,000 ransom by November 21, 2025. Doctor Alliance was alerted on November 13, 2025, notified the FBI on November 16, 2025, and posted a public notice on its website. Multiple home-health clients including Amedisys, AccentCare, Angels Care Home Health, and Prima Care subsequently issued downstream patient notifications. The breach affected approximately 387,000 individuals based on records indexed by breach-tracking services, with approximately 33,000 unique Social Security numbers and 7,900 unique email addresses among the records. Compromised fields included patient names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, medical record numbers, Medicare numbers, diagnoses, treatment information, medications, and provider information. Although the hacker's claim of 1.24 million files initially suggested 1.2 million affected individuals, subsequent analysis indicated the actual patient-individual count is substantially smaller, with many files representing duplicate documents for the same patients across multiple home-health visits. For affected patients, the practical risk profile combines identity-fraud exposure with home-health and Medicare-specific risks. The combination of name, address, date of birth, and Social Security number is a strong base for synthetic identity fraud and fraudulent credit applications. Inclusion of Medicare numbers raises direct healthcare-fraud risk including fraudulent home-health billing. Inclusion of medication and diagnosis information supports highly targeted medical-themed phishing referencing real prescriptions and treatments. Patients receiving home-health services are categorically more vulnerable to medical-fraud and emotional-manipulation scams because they are often elderly or recovering from illness. Affected patients should freeze credit at all three U.S. bureaus, monitor Medicare summary notices and home-health billing statements closely, alert family caregivers to be cautious of unsolicited contact, and treat unsolicited communications referencing Doctor Alliance, home-health agencies, or Medicare with caution.
Full threat analysis, exploitation vectors, and principal guidance below.
11 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
387K records analyzed
About Doctor Alliance
Doctor Alliance (operating as My 485, Inc.) is a Dallas, Texas-based healthcare technology company that provides clinical document management, billing, and physician-workflow services to home health agencies and physician practices across the United States. The company's platform integrates with electronic health record systems and processes high volumes of clinical and administrative data, including patient documents, plan-of-care signatures, and Medicare 485 forms. Doctor Alliance's clients include major U.S. home health operators such as Amedisys, AccentCare, Interim HealthCare, Angels Care Home Health, and Prima Care. As a HIPAA-regulated healthcare business associate, Doctor Alliance maintains substantial volumes of protected health information aggregated across its many home-health and physician clients, alongside provider records, scheduling information, and billing data.
Why They Hold Your Data
Healthcare workflow and billing platforms collect patient identity, provider records, billing data, clinical documents, scheduling information, and physician workflow records across practice-management operations.
Recent Developments
Doctor Alliance was alerted to a cybersecurity incident on November 13, 2025 after a hacker using the alias 'Kazu' posted on an underground hacking forum on November 7, 2025 claiming to have stolen 1.24 million files totaling 353 GB from Doctor Alliance's systems. The hacker demanded a $200,000 ransom by November 21, 2025, threatening to sell the data if payment was not made. Doctor Alliance's investigation determined that an unknown unauthorized party had obtained Doctor Alliance web-portal credentials and accessed certain files intermittently between October 31, 2025 and November 17, 2025. The unauthorized party also used a script to send multiple requests to the Doctor Alliance web portal using varying combinations of patient IDs and document numbers, indicating credential abuse and enumeration rather than ransomware encryption. Doctor Alliance notified the FBI on November 16, 2025 and posted a public notice on its website. Affected home-health clients including Amedisys (notified January 5, 2026), Angels Care (notified January 13, 2026), and AccentCare (notified February 2026) issued downstream patient notifications. Multiple class-action lawsuits were filed in the U.S. District Court for the Northern District of Texas, Dallas Division.
Data Points Exposed
4 verified field types
Email Address
Full Name
Phone Number
Social Security Number Critical
Breach Impact
The institutional impact on Doctor Alliance is substantial given the platform's role as a back-office layer for major U.S. home-health operators. Federal HIPAA notification obligations as a business associate, an active Office for Civil Rights review, multistate attorney-general filings, and active class-action litigation in the U.S. District Court for the Northern District of Texas are all underway. The credential-abuse pathway raises broader questions about Doctor Alliance's authentication architecture, particularly the absence of multi-factor authentication and rate-limiting that would have impeded the enumeration script. Downstream client relationships have been affected, with Amedisys, AccentCare, and other major home-health operators issuing public notices that explicitly attribute the breach to Doctor Alliance rather than to their own systems. Reputational impact extends across the home-health technology vendor market.
Exploitation & Downstream Threats
• Identity theft and synthetic identity construction using government-issued IDs | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses
Principal Risk Advisory
What this means for a principal
A healthcare-linked breach: exposure ties a named individual to a provider relationship and, where clinical or insurance data is present, to conditions and treatment. For a high-profile principal the main risk is credible impersonation and enrichment of existing exposure.
What You Should Do
- Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
- Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
K
Threat Actor: KazuConfidence: Low
Motivation: Unknown
A generic alias that cannot be reliably profiled without source context. It may refer to a forum handle, Telegram account, or unrelated identity.
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation