TWO unrelated medical practices named Nephrology Associates suffered cyberattacks this year, but only one has publicly disclosed the breach. In Kansas, Nephrology Associates, M.D., P.A. reported to the US Department of Health and Human Services on 29 July that 24,088 patients were affected.
Their notice states that unauthorized access occurred between 17 January 2026 and 9 April 2026, with data including full names and one or more identifiers such as Social Security numbers, dates of birth, driver’s licence numbers, other health IDs, treatment or diagnosis information, and health insurance details. The group did not provide evidence of the breach itself beyond the notice, and DataBreaches[.]net has not verified any data leakage beyond the public claim.
In Arkansas, Nephrology Associates, PA was added to the Insomnia ransomware group’s leak site on 28 April. Insomnia claimed they had notified the practice on 6 April 2026 and depicted proof via screenshots. The firm’s website appears silent beyond the leak claims, and there has been no corresponding HHS notification or public notice on the practice’s site.
DataBreaches[.]net reviewed the alleged data tranche and found substantial health insurance information and personal data, including 550 pages of primary and secondary health insurance records and other files containing demographic and medical data, with some records appearing to include full Social Security numbers. SuspectFile previously reported that Insomnia leaked data in late April. At the time of reporting, DataBreaches[.]net could not confirm any state or federal lawsuits relating to either breach.