Freedman HealthCare Consulting Firm Breach (2025): 4 Million Records Including SSN & Home Address Exposed via Ransomware

About Freedman HealthCare

Freedman HealthCare is a Massachusetts-based data and analytics consulting firm that designs and manages health data infrastructure for U.S. state agencies, health insurers, and other healthcare organizations. Its work includes building All-Payer Claims Databases — systems that aggregate healthcare claims data across payers for public health analytics and policy purposes. Client engagements have included state health agencies in California, Rhode Island, Delaware, Hawaii, and Massachusetts, among others.

Why They Hold Your Data

Healthcare consulting and analytics firms collect client, provider, patient, claims, and program data across advisory, policy, and healthcare data-analysis workflows.

Recent Developments

Freedman HealthCare operates as a specialized boutique consultancy in the public health data infrastructure space. No major organizational changes have been publicly reported beyond the 2025 breach and its aftermath.

Data Points Exposed

Breach Impact

In late April 2025 Freedman HealthCare discovered a security incident affecting a single file server. World Leaks — formerly Hunters International, now operating as a pure data theft and extortion group — claimed responsibility, alleging exfiltration of 52.4 gigabytes across 42,000 files. When Freedman declined to pay the ransom, World Leaks published the files on its dark web leak site in June 2025. CEO John Freedman publicly maintained that no protected health information was compromised, and that no all-payer claims data was affected. Researchers reviewing the published files found management credentials, employee personnel records including visa applications, bank statements, tax documents, pay stubs, and state contracts — as well as plaintext login credentials to state client accounts, which created potential downstream access risk to sensitive public health data systems. Freedman notified affected individuals under Massachusetts breach notification law, engaged external cybersecurity experts, and reported the incident to law enforcement. A law firm announced a breach investigation in June 2025.

Exploitation & Downstream Threats

• Identity theft and synthetic identity construction using government-issued IDs | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure

What You Should Do

1. Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
2. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
3. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
4. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).