VirMedice 2025 Data Breach
ObscureIQ Breach Intelligence
High SeverityWebsite / service breach
VirMedice EHR / Practice-Management Vendor Breach (2025): Patient SSN, DOB & Medical Diagnoses Exposed via PEAR Ransomware
Healthcare IT vendor providing EHR, practice-management, and medical-data-management software (SaaS/hosted).
Verified by ObscureIQ Intelligence
88/100Breach Risk Index
63Data Value
40Market Recency
255dSince Breach
Breach Intelligence Summary
Entity: VirMedice · Actor: PEAR · Sources: 2 references
Attack: Ransomware / Extortion
Profile: Healthcare Technology Company · Electronic health records and practice management software · Healthcare IT reseller and managed cloud services provider · USA
Timeline: Breach (2025-09-11) · Year (2025)
Exposure: 1.1M records · 7 fields: Date of Birth, Email Address, Full Name, Medical Diagnosis, Phone Number, Physical Address, Social Security Number
Status: Confirmed
Executive Summary
VirMedice, LLC, a healthcare IT vendor providing EHR and practice-management software, suffered a ransomware attack attributed to the PEAR group and discovered on September 16, 2025. Exposed data reportedly included names, Social Security numbers, dates of birth, home/street addresses, phone numbers, email addresses, and medical diagnoses. Because VirMedice hosts data for multiple provider clients, the breach carries downstream exposure. The affected-individual count is not officially confirmed; a DataBreach.com parse cited roughly 1,116,576 records. The breach is catalogued by DataBreach.com and ransomware trackers.
ObscureIQ assessment: High risk because the company may sit inside multiple clinical systems at once. Exposure can enable medical fraud, provider impersonation, ransomware targeting, and compromise of downstream healthcare clients.
Breach Impact
Because VirMedice hosts EHR and practice-management data for multiple provider clients, a single breach can expose patients across many practices at once. The circulating data combined Social Security numbers, dates of birth, addresses, and medical diagnoses, an unusually complete bundle enabling identity theft, synthetic-identity and medical fraud, provider impersonation, and downstream compromise of the clinics that rely on VirMedice.
About VirMedice
VirMedice, LLC is a U.S. healthcare technology company providing electronic health record (EHR), practice-management, and medical-data-management software to medical practices under SaaS and hosted deployment models. As a healthcare IT vendor, it stores protected health information on behalf of multiple provider clients, sitting inside their clinical and billing systems.
Why They Hold Your Data
Healthcare IT resellers and managed cloud providers collect provider, patient, billing, infrastructure, and administrative records across electronic health record and practice-management deployments.
Recent Developments
VirMedice discovered a ransomware incident on September 16, 2025, attributed to the PEAR group, which listed the company on its dark-web leak site. As a healthcare IT vendor holding data for multiple practices, the breach carries downstream exposure for its provider clients; the affected-individual count had not been officially confirmed. Class-action investigations followed.
Data Points Exposed
7 verified field types
Date of Birth High
Email Address
Full Name High
Medical Diagnosis Critical
Phone Number
Physical Address High
Social Security Number Critical
Field names are shown in full for clarity and search visibility. Canonical machine keys are emitted only in this page’s structured data.
Exploitation & Downstream Threats
Threat Activity:Critical
Primary downstream threats:
- Identity theft and synthetic identity construction using SSN, DOB, name, address
- Medical identity fraud and insurance abuse using diagnosis data
- Identity verification bypass using name + DOB
- Downstream compromise/impersonation of VirMedice provider clients
- Targeted phishing and vishing referencing medical care
- Doxxing and physical targeting from exposed addresses
Threat vectors:
- Full identity theft & synthetic identity fraud
- Medical extortion, insurance fraud & discrimination
- Identity verification bypass
- Downstream vendor/provider compromise
- Name-based social engineering
- SIM swapping, vishing & SMS phishing
- Home targeting, stalking & physical threat
Threat Actor: PEAR
PEAR
Ransomware / Extortion
Attribution and method are based on available breach intelligence. Reported attack vector: Ransomware / Extortion.
Recommended Actions
If you believe your information may be included:
Protect Your ID Documents
Government-ID exposure enables document fraud — monitor and report misuse.
Enable MFA Everywhere
Turn on multi-factor authentication on email first, then financial accounts.
Report & Recover
If you spot misuse, start an official recovery plan and report fraud.
Frequently Asked Questions
What happened in the VirMedice breach?▾
VirMedice, LLC, a healthcare IT vendor providing EHR and practice-management software, suffered a ransomware attack attributed to the PEAR group and discovered on September 16, 2025. Exposed data reportedly included names, Social Security numbers, dates of birth, home/street addresses, phone…
What data was exposed?▾
Verified fields include Date of Birth, Email Address, Full Name, Medical Diagnosis, Phone Number, Physical Address, Social Security Number.
What should I do if I was affected?▾
Change reused passwords, enable MFA, and (if identity or financial data is involved) freeze your credit and monitor your accounts.
Sources & References
Every claim on this page is traceable. This breach draws on:
Breach Index
ObscureIQ Intelligence
ObscureIQ proprietary analysis
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation