A ransomware group claims it stole a massive patient claims database tied to 159 Solutions, Inc., allegedly including pharmacy and medical claims, diagnosis codes, and patient identifiers. The company has not confirmed this incident. Affected individuals should review insurance statements for unfamiliar charges and watch closely for phishing attempts referencing medical details.
| Company | 159 Solutions, Inc. |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Pharmacy Claims Records, Medical Claims Records, Remittance Adjustment Records, Patient Birth Year and Gender, Prescriber Names and NPI Numbers, Patient Identifiers, National Drug Codes and Diagnosis Codes, Payer Information Including Medicare Advantage |
| People Affected | Not Publicly Disclosed |
| Attack Method | Ransomware |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the 159 Solutions, Inc. Data Breach?
A ransomware group has posted a listing claiming it obtained a large trove of patient claims data connected to 159 Solutions, Inc. The group’s claim describes a massive specialty pharma data analytics warehouse. As of now, 159 Solutions has not publicly confirmed this incident.
According to the claim, the exposed data set includes hundreds of millions of rows tied to a June 2025 reporting period. The listing describes pharmacy claims, medical claims, and remittance adjustment records. Because this information comes from a threat actor’s own leak-site posting, it should be treated as an unverified claim rather than a confirmed fact.
The breach discovery date has not been publicly disclosed. Similarly, there is no confirmed notification timeline available at this time. Independent forensic verification of the claim has not been reported, so the scope and accuracy of the listing remain unconfirmed.
Because the source is a ransomware group’s extortion posting, important details remain unclear. For example, it is not confirmed how the alleged access occurred or how long it may have persisted. Readers should understand this 159 Solutions data breach report as a claim under review, not an established finding.
Who was affected?
The claim suggests the exposed data could affect patients whose pharmacy and medical claims passed through systems tied to 159 Solutions. In addition, the listing references client environments connected to at least seventeen specialty pharma manufacturers. This suggests the alleged impact could extend beyond a single company’s own records.
The exact number of individuals affected has not been publicly disclosed. Because the claim describes a patient claims warehouse used across many manufacturer relationships, the potential population could be large. However, no verified affected count is currently available.
It is not known whether minors are among those potentially affected. The claim does reference birth years and gender for patient records, which suggests individuals across a broad age range could be involved. Still, this detail comes only from the threat actor’s own description.
Given the national scope implied by the claim, affected individuals could reside across the United States. As a result, people who have used specialty pharmacy services or had claims processed through related manufacturer programs may want to stay alert for updates.
What Information Was Potentially Exposed?
The ransomware group’s listing describes several categories of data it claims to have obtained. Because this is an unconfirmed claim, these categories should be read as reported rather than verified. The listing specifically references the following data types.
- Pharmacy claims records
- Medical claims records
- Remittance adjustment records
- Patient records including birth year and gender
- Prescriber names, National Provider Identifiers and practice addresses
- Patient identifiers linked across pharmacy and medical claims
- National drug codes and diagnosis codes
- Payer information, including references to Medicare Advantage
If accurate, this type of data could allow bad actors to piece together sensitive details about a person’s health conditions and treatments. For example, diagnosis codes combined with prescriber information could reveal what medications someone takes and why. This kind of exposure can lead to targeted phishing attempts that reference real medical details, making scams more convincing.
In addition, when claims data includes identifiers tied to Medicare Advantage or other payer programs, there is a risk of fraudulent billing schemes. Criminals sometimes use stolen claims information to submit false insurance claims. Because this incident remains unconfirmed, affected individuals should still watch for unusual insurance statements or unexpected medical bills as a precaution.
What is the company doing?
159 Solutions, Inc. has not issued a public statement confirming this incident. Because the available information comes from a ransomware group’s leak-site posting, there is no confirmed description of any investigation, remediation, or notification process at this time.
As a result, it is not possible to describe specific protective steps the company has taken. If 159 Solutions issues an official statement or begins notifying affected individuals, that information would typically include details about credit monitoring or identity protection services, where applicable. Until then, affected individuals should rely on verified updates rather than the claim alone.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Affected individuals should check their credit reports regularly for unfamiliar accounts or inquiries. You can request free reports from each of the three major credit bureaus. Reviewing these reports often helps catch fraudulent activity early.
Because this claim involves health-related data rather than confirmed Social Security numbers, traditional credit fraud risk may be lower. However, monitoring remains a smart habit whenever personal data may be involved in a breach claim. Set a recurring reminder so you don’t forget to check periodically.
Watch for Phishing and Medical Scams
Be cautious of emails, calls, or texts referencing medical claims, prescriptions, or insurance details. Scammers often use real-sounding details to appear legitimate. This tactic becomes more effective when attackers have access to genuine claims data.
Therefore, never click links or share personal information in response to unsolicited messages. Instead, contact your healthcare provider or insurer directly using a known phone number. This way, you can confirm whether any communication is genuine.
Review Insurance Statements Carefully
Because the claim references payer and remittance data, affected individuals should review their insurance explanation-of-benefits statements closely. Look for services or prescriptions you don’t recognize. Unfamiliar charges could indicate fraudulent claims activity.
If you spot anything suspicious, report it to your insurer immediately. Prompt reporting can limit further misuse and help the insurer flag the activity. Keep records of any discrepancies you find for your own documentation.
Consider Consulting a Data Breach Attorney
If this claim is later confirmed and your information was involved, you may want to speak with a data breach attorney. Many offer free case evaluations to help you understand your options. This step can clarify whether you qualify for compensation if a class action develops.
In the meantime, keep an eye on official communications from 159 Solutions or regulatory bodies. Documentation of any suspicious activity you experience can strengthen a potential future claim. Acting early often preserves more options later.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.