ApolloMD notifies patients of 11 physician practices affected by a June cyberattack

ApolloMD notified patients about a June cyberattack affecting 11 physician practices, after Qilin added ApolloMD to its darkweb leak site with a June 6 claim and 238 GB of files. The incident involved unauthorized access on May 22–May 23, and ApolloMD subsequently issued substitute notices on 15 September detailing the data involved.

According to DataBreaches[.]Net, the notice states that patient names, dates of birth, addresses, diagnosis information, provider names, dates of service, treatment information and/or health insurance information were affected, with some individuals possibly having Social Security numbers involved; those patients are being offered complimentary credit monitoring with CyberScout.

ApolloMD notified the listed practices between 21 July 2015 and 11 September 2025, and on 17 September it sent notification letters to affected patients. The incident has not yet appeared on HHS’s public breach tool, so the total number of patients affected remains unknown. Pensacola Hospitalist Physicians separately notified the New Hampshire Attorney General’s Office, while other regulators have not shown up in routine searches.