TriMed (Henry Schein) Orthopedic Implant Maker Breach (2025): 81K Patient Records Including DOB & Medical Record Numbers Exposed via LYNX Ransomware

About TriMed, Inc.

TriMed, Inc. is an orthopedic implant and medical-device manufacturer based in Santa Clarita, California, producing fixation systems and surgical implants for orthopedic procedures. It was acquired by dental and medical distribution company Henry Schein, Inc. (NASDAQ: HSIC) in April 2024. Because it processes orthopedic implant orders, it holds limited patient-linked information (such as names, dates of birth, and medical record numbers) within order forms and invoices, alongside provider and business records.

Why They Hold Your Data

Healthcare receivables and revenue-cycle firms collect patient identity, billing, insurance, claims, provider, and account-balance records across collections and financial workflows.

Recent Developments

TriMed was acquired by Henry Schein in April 2024. An unauthorized party accessed TriMed systems between roughly September 13 and 21, 2025; the LYNX ransomware group claimed responsibility on October 2, 2025. TriMed discovered the incident on January 23, 2026 and notified 81,203 individuals, offering 24 months of credit monitoring. Class-action investigations followed.

Data Points Exposed

Breach Impact

Compared with typical healthcare breaches, the exposure was relatively limited: the affected files were largely orthopedic implant order forms and invoices, most of which contained no personal information, though some included names, dates of birth, and medical record numbers. Social Security numbers were not involved, which materially lowers identity-theft risk. Still, the data confirms an orthopedic-implant care relationship and can support medical-themed phishing, and the incident carries HIPAA/OCR and litigation exposure for TriMed and its parent, Henry Schein.

Exploitation & Downstream Threats

• Medical-themed phishing referencing orthopedic implants, surgery, or billing | • Limited medical identity linkage using name + date of birth + medical record number | • Targeted scams confirming an orthopedic care relationship

What You Should Do

1. Watch for medical-benefit fraud and health-themed phishing that references real provider relationships.
2. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping: cross-reference the exposed identifiers against broker-available data to size and prioritize the principal's wider footprint.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).