Unlimited Technology Systems, an Ohio-based healthcare software and billing vendor, disclosed in August 2026 that a five-day intrusion in October 2025 exposed the personal and medical records of approximately 3.8 million people — making it the largest U.S. healthcare data breach of the year to date. Exposed data spans SSNs, medical record numbers, diagnoses, insurance details, and scanned copies of driver's licenses and government IDs. Freeze your credit at all three bureaus, request an accounting of disclosures from your provider, and shrink your data-broker footprint so attackers cannot cross-reference the leak with your current whereabouts.
What Happened in the Unlimited Technology Systems Data Breach?
The timeline:
- October 5–10, 2025: An unauthorized actor accessed files in Unlimited Technology Systems' commercial data center for a five-day period and may have obtained copies of personal information belonging to patients of the healthcare providers Unlimited serves.
- October 2025: Unlimited detected unauthorized activity, isolated affected systems, and engaged third-party forensic responders. Law enforcement was notified.
- Late 2025 – mid 2026: Forensic investigation to identify which specific files were accessed and which patients were affected.
- August 2026: Unlimited Technology Systems filed its report with the U.S. Department of Health and Human Services listing approximately 3.8 million affected individuals and began mailing notification letters through the affected provider organizations. As of August 2026, no ransomware group has publicly claimed responsibility.
Unlimited Technology Systems provides revenue cycle management, practice management, and billing software to more than 4,500 clinics and 6,500 specialty healthcare providers across the United States, processing more than $70 billion in net healthcare charges annually. You may be affected even if you have never heard of Unlimited: your provider likely does not name their billing vendor on the visit paperwork.
What Data Was Exposed?
Per the HHS filing and notification letters, the compromised data may include:
- Full name and date of birth
- Home address, phone number, and email
- Social Security number
- Medical record number, diagnoses, and dates of service
- Health insurance policy numbers, claims data, and benefits information
- Scanned documents — driver's licenses, other government-issued IDs, and insurance cards
- Intake forms and demographic information
Why scanned IDs make this breach uniquely bad
Most breaches leak SSN plus name. Unlimited also leaked photographs of your driver's license and insurance card. Those images bypass many identity-verification systems that rely on "upload a photo of your ID" — used by banks, brokerages, crypto exchanges, and telehealth platforms. Expect account-opening fraud that uses your real ID scan, not just your data. Treat this breach as high severity.
Are You Affected?
Assume affected if:
- You received a notification letter from your healthcare provider or from Unlimited Technology Systems in 2026
- You have received care at any of the 4,500+ U.S. clinics or 6,500+ specialty providers that outsource billing or practice management to Unlimited
- Your provider was disrupted by billing or portal outages in October 2025 (a common tell for Unlimited customers during the incident)
If you are unsure whether your clinic uses Unlimited, call the office and ask — but do not delay the credit freeze in step 1 below; it is free and reversible.
Is your data already out there?
Leaked data ends up on broker sites and in scammers' hands. Run a free 60-second scan to see your exposure — then let us remove it.
Run a free scan★★★★★ 4.8/5 · Trusted by thousands of families
Immediate Steps to Take
Step 1: Freeze Your Credit at All Three Bureaus
Because SSNs and government IDs were exposed, a credit freeze is the single most important action. Freeze at all three bureaus:
Step 2: Watch for Medical Identity Theft
Medical identity theft can corrupt your medical record and stick you with fraudulent bills. This month:
- Request an Explanation of Benefits (EOB) from your insurer for the past 12 months and flag any claim you did not incur
- Ask each provider for an accounting of disclosures under HIPAA and a copy of your medical record; flag anything you don't recognize
- File a report with your insurer's fraud department if you see suspicious claims
- Request a free copy of your Medical Information Bureau (MIB) report to check for entries under your name
Step 3: Replace Your Driver's License if Practical
Because photographs of your actual ID were exposed, consider requesting a new driver's license number from your state DMV. Rules vary by state — some issue a new number only for confirmed identity theft, others allow it after a breach. Even where a new number isn't available, request a new physical card so future automated systems that check the card's issue date can flag old scans as stale.
Step 4: Add IP PIN and Tax Fraud Protection
SSN leaks fuel tax-refund fraud. Request an IRS Identity Protection PIN (IP PIN) at IRS.gov so no one can file a return in your name without it. File your own taxes as early as possible next season.
Step 5: Move 2FA Off SMS and Watch for Medical-Themed Phishing
Expect phishing that references your real doctor, real diagnosis, or real insurance carrier. Switch 2FA on email, banking, insurance portals, and patient portals from SMS to an authenticator app or hardware security key. Never click links in a breach notice; type the URL yourself. Legitimate providers will never ask for your SSN or password by email.
Cut the Trail: Remove Your Data From Broker Sites
The Unlimited leak by itself gives attackers a rich medical and identity profile. It becomes far more dangerous when paired with data-broker records — current address, relatives, employer, phone number — which they can buy for pennies on Spokeo, BeenVerified, Whitepages, and 100+ similar sites. Removing your data from those brokers breaks the chain: cross-referencing the Unlimited dump against a name that returns nothing on the public web is far less useful to an attacker.
PrivacyOn shrinks your public footprint fast
PrivacyOn removes your personal information from 100+ major data broker sites, adds 24/7 dark web monitoring so you know when your info surfaces in new dumps, and covers up to 5 family members from $8.33/month. Start with a free scan to see exactly which brokers are exposing your address and phone — the same data attackers will try to combine with the Unlimited Technology Systems leak. Any monitoring included with your breach notice is reactive; PrivacyOn shrinks the exposed surface first, which is what stops most opportunistic attackers.
Longer-Term Protection
- Use email aliases for medical portals and provider signups (iCloud Hide My Email, Firefox Relay, DuckDuckGo Email Protection) so one leak doesn't burn your primary inbox
- Enable transaction alerts on every bank account and card so you see fraud in real time
- Set fraud alerts at all three credit bureaus as a supplement to the freeze
- Read every EOB from your insurer for the next year and flag any service you did not receive
- Report suspected identity theft at IdentityTheft.gov for a free FTC recovery plan
Frequently Asked Questions
Is the Unlimited Technology Systems 2026 data breach confirmed?
Yes. Unlimited Technology Systems filed a report with the U.S. Department of Health and Human Services in August 2026 confirming approximately 3.8 million affected individuals. The intrusion occurred October 5–10, 2025 in the company's commercial data center; notifications began through affected provider organizations in mid-2026.
How many people are affected by the Unlimited Technology Systems breach?
Approximately 3.8 million patients. This is the largest U.S. healthcare data breach reported so far in 2026, ahead of the 3.4 million-record TrizettoProvider Solutions breach earlier in the year.
What information was exposed in the Unlimited Technology Systems breach?
Names, dates of birth, addresses, phone numbers, emails, Social Security numbers, medical record numbers, diagnoses, dates of service, insurance policy numbers, claims and benefits information, and scanned documents such as driver's licenses, other government IDs, and insurance cards.
Why did the notifications take so long — the breach was in October 2025?
Healthcare breach forensics regularly take six to twelve months to complete because investigators must review every file the intruder accessed and correlate them to individual patients across thousands of providers. The delay is frustrating but does not change the actions you should take now.
Do I need to freeze my credit after the Unlimited Technology Systems breach?
Yes — SSNs and scanned government IDs were exposed, so a credit freeze at Equifax, Experian, and TransUnion is essential. Freezes are free, take minutes to place, and can be temporarily lifted when you need to apply for credit.
Can I sue Unlimited Technology Systems over the 2026 breach?
Multiple plaintiffs' firms announced investigations into potential class actions in August 2026. If you are affected, save your notification letter and any related correspondence; you may qualify to join a class action later. This is not legal advice — consult an attorney for your situation.
Is there a service that can shrink my exposure after a breach like this?
Yes — PrivacyOn is our top pick. It removes your personal information from 100+ data broker sites so attackers cannot cross-reference the Unlimited leak with your current address, phone, and relatives, adds 24/7 dark web monitoring for your email and SSN, and covers up to 5 family members from $8.33/month. Any breach-response monitoring you were offered will only alert you after fraud has happened; PrivacyOn shrinks the exposed surface first, which is what stops most opportunistic attackers from picking your record out of the Unlimited dump.