ModMed revealed they were victims of a cyberattack in July. Then some data showed up for sale.

ModMed revealed they were victims of a cyberattack in July, with the incident traced to July 29 when unauthorized activity was detected on some of its computer servers. The data on those servers, drawn from podiatry clients, were accessed and exfiltrated between 9 July and 10 July 2025. ModMed notified impacted providers on 19 September and notified affected patients on 17 October.

According to its notification letter, the information involved included full names, addresses, dates of birth, Social Security numbers, phone numbers, email addresses, health insurance information, medical record numbers, patient account numbers, dates of service, providers, practice names, billing and diagnostic codes, prescription and medication information, as well as diagnosis and treatment information. No criminal group has claimed responsibility for the July attack as of publication, though there was discussion of a possible second attack for sale.

On 20 October a listing appeared on the Breachst rs forum claiming 1,003 records, later linked to a data sample that DataBreaches noted contained a significant amount of PHI and records related to podiatry visits; DataBreaches said there was no evidence of a second attack, but there is evidence that data from as many as 1,500 podiatry patient records are in the hands of someone trying to sell them.