Heart South Cardiovascular Group 2025 Data Breach
Healthcare provider · Cardiovascular care services · Specialty clinic network · USA
Heart South Cardiovascular Group Cardiology Breach (2025): Patient SSN & DOB Exposed
Cardiology practice providing heart and vascular care.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
75/100
Lower riskHigher risk
High and current: recent, valuable data circulating on the dark web now.
Data Sensitivity i
ElevatedExposed data raises the risk of fraud, targeting, and impersonation. Proactive steps are warranted.
48KRecords
2025Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Crucial data exposed
SSNSocial Security Number
Breach Summary
Heart South Cardiovascular Group, a cardiology practice in Central Alabama, learned on November 11, 2025 that an unauthorised third party claimed to possess data from its network. A forensic investigation conducted with external cybersecurity specialists found that data had been uploaded to the dark web. The practice formally identified the affected records on February 12, 2026 and began notifying affected individuals on April 6, 2026. The Rhysida ransomware group has been associated with the incident.\n\nThe breach affected approximately 47,000 individuals according to the Maine Attorney General notification. Compromised fields included names, email addresses, phone numbers, dates of birth, and Social Security numbers, alongside cardiovascular treatment information including diagnoses, procedures, medications, and health insurance details. This is the second public breach at Heart South: a separate May 2024 incident affected approximately 20,577 individuals and was resolved in 2025 through a $500,000 class-action settlement.\n\nFor affected patients, the practical risk profile combines identity-fraud exposure with cardiovascular care-specific risks. The combination of name, date of birth, and Social Security number is a strong base for synthetic identity fraud and fraudulent credit applications. Inclusion in the dataset confirms the existence of a cardiology care relationship, which can support medical-themed scams referencing real cardiac procedures, medications, or insurance claims. Patients with cardiovascular conditions are particularly attractive targets for emotionally manipulative scams because their care relationships are emotionally charged and high-frequency. Affected individuals should accept the complimentary identity-monitoring through Kroll, freeze credit at all three U.S. bureaus, monitor health-insurance statements, and treat unsolicited contact referencing the practice, cardiac treatment, or insurance verification with caution.
Full threat analysis, exploitation vectors, and principal guidance below.
11 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
48K records analyzed
About Heart South Cardiovascular Group
Heart South Cardiovascular Group is a U.S.-based cardiology practice headquartered in Alabaster, Alabama, with additional locations in Clanton and Centreville. The practice specialises in cardiac and vascular medicine, providing services including diagnostic cardiac testing, interventional cardiology, preventive cardiology, and ongoing cardiovascular care to patients across Central Alabama. As a HIPAA-regulated healthcare provider, Heart South maintains substantial volumes of protected health information including patient identity, contact, insurance, billing, diagnostic, and cardiovascular treatment records. The patient base includes long-term cardiac patients whose conditions often require continuous monitoring and care.
Why They Hold Your Data
Specialty medical providers collect patient identity, medical history, diagnostic data, insurance records, and billing information tied to cardiovascular care.
Recent Developments
Heart South Cardiovascular Group was informed on November 11, 2025 that an unauthorised third party claimed to possess data from its network. A forensic investigation conducted with external cybersecurity specialists was launched. The practice notified the Maine Attorney General on April 6, 2026 and began mailing notifications to affected individuals on the same date. The Rhysida ransomware group has been associated with the incident. This is the second known breach at Heart South in eighteen months: a separate May 2024 incident affected approximately 20,577 individuals and was resolved in 2025 through a $500,000 class-action settlement filed in the Circuit Court of Bibb County, Alabama. Class-action investigations relating to the November 2025 incident have begun.
Data Points Exposed
5 verified field types
Date of Birth High
Email Address
Full Name
Phone Number
Social Security Number Critical
Breach Impact
Heart South faces compounding institutional exposure given that the November 2025 incident is the practice's second public breach in eighteen months. The May 2024 settlement of $500,000 establishes a clear cost benchmark for likely outcomes in pending litigation. Federal HIPAA notification obligations, attorney-general filings across multiple states given the dispersed patient population, and class-action exposure all add to the compliance and legal cost base. The reputational impact is concentrated within the Central Alabama cardiology market and is heightened by the recurrence of incidents. Operationally, the practice continues to provide patient care, and is offering complimentary identity-monitoring services through Kroll to affected individuals.
Exploitation & Downstream Threats
• Identity theft and synthetic identity construction using government-issued IDs | • Identity verification bypass using name + date of birth combination | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses
Principal Risk Advisory
What this means for a principal
A healthcare-linked breach: exposure ties a named individual to a provider relationship and, where clinical or insurance data is present, to conditions and treatment. For a high-profile principal the main risk is credible impersonation and enrichment of existing exposure.
What You Should Do
- Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
- Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
R
Threat Actor: RhysidaConfidence: High
Motivation: Financial extortion
A ransomware-as-a-service group using double extortion. CISA reporting notes targeting across education, manufacturing, IT, government, and healthcare.
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation