Troops and veterans’ personal information leaked in CPAP Medical data breach

In December 2024, CPAP Medical Supplies and Services Inc., a Jacksonville, Florida-based provider of sleep therapy services, experienced a cybersecurity incident that compromised the personal data of over 90,000 patients. An unauthorized actor accessed CPAP’s network between December 13 and December 21, 2024, and the breach was not detected until late June 2025, with affected individuals being notified by mid-August.

The stolen data includes full names, birth dates, Social Security numbers, health insurance information, medical history, and treatment plans. CPAP says it is unaware of any misuse of patient data as a result of the incident, but affected individuals have been offered free credit monitoring and identity theft protection as a precaution. The provider emphasises that most of its patients are military members, veterans and their families, given its focus on tailored sleep apnea equipment for the US military.