A ransomware group claims it stole patient eye examination records, medical history, and staff credentials from Andrews Advisory Group LLC in Chicago. The company has not confirmed the breach publicly. If you received care through this organization, monitor your credit reports and insurance statements closely, and consider consulting a data breach attorney for guidance.
| Company | Andrews Advisory Group LLC |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Patient Names and Dates of Birth, Patient Database Backups, Eye Examination Records, Medical and Social History, OCT Eye Scan Imaging Files, Staff Workstation Credentials |
| People Affected | Not Publicly Disclosed |
| Attack Method | Ransomware |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Andrews Advisory Group LLC Data Breach?
A ransomware group has claimed responsibility for stealing data from Andrews Advisory Group LLC, a Chicago-based firm. The group posted the claim to its dark web leak site, stating the company did not pay a ransom demand. As a result, the attackers say they released or listed the stolen files publicly.
According to the group’s posting, the stolen data was taken from the company’s office network. The claim describes a patient database backup from December 2025, along with a complete backup history stretching from 2018 through 2025. The group also says it accessed eye examination records and imaging files from a medical imaging server.
Because this is an unauthorized claim from a threat actor, Andrews Advisory Group LLC has not publicly confirmed the incident. No independent forensic report or company statement currently verifies the scope of what was taken. The breach discovery date has not been publicly disclosed, and the timeline of the intrusion itself remains unclear.
Investigations into claims like this one typically take time. Until the company or a regulator confirms details, affected individuals should treat the posted claim seriously but understand it is not yet an official finding. This distinction matters for anyone trying to assess their own risk right now.
Who was affected?
The leak site claim suggests both patients and employees may be affected. The group specifically references patient records, which implies individuals who received eye examinations or related medical services through systems connected to Andrews Advisory Group LLC’s network.
In addition, the claim mentions workstation profiles belonging to office staff, including stored system credentials. This suggests employees could also be affected, separate from any patient population. However, because the company has not confirmed the incident, the precise relationship between the organization and the patient database referenced is not fully clear from public information.
The total number of affected individuals has not been publicly disclosed by the company. The ransomware group’s post references more than 13,000 eye examination records and nearly 3,700 patient records tied to the December 2025 backup. These figures come solely from the attacker’s claim and have not been independently verified.
Because the alleged database history spans 2018 through 2025, the population affected could include patients across several years. This means both recent patients and those who had not interacted with the organization in some time could potentially be included, if the claim proves accurate.
What Information Was Potentially Exposed?
The ransomware group’s claim lists several categories of data it says were taken. These categories have not been confirmed by Andrews Advisory Group LLC itself, so they should be understood as allegations at this stage.
- Patient names and dates of birth
- Patient database backups spanning 2018 through 2025
- Eye examination records including full ocular, medical, and social history
- OCT eye scan imaging files
- Workstation profiles and stored system credentials of office staff
If these claims are accurate, the risk to affected patients could be significant. Medical and ocular history combined with names and birth dates can be used to commit medical identity theft. For example, a criminal could use this information to file fraudulent insurance claims or obtain medical services under someone else’s identity.
Beyond medical fraud, stolen credentials belonging to staff members raise separate concerns. If system credentials were genuinely exposed, attackers could potentially use them to access other connected systems. This could lead to further unauthorized access well beyond the original incident, which is why prompt password changes matter for any employee connected to the network.
What is the company doing?
Because this incident stems from a claim posted by a ransomware group, there is no public record of Andrews Advisory Group LLC confirming the breach. Therefore, no details about an internal investigation, forensic review, or remediation plan have been made public at this time.
Similarly, there is no publicly available information indicating the company has notified affected individuals or regulators. This does not necessarily mean no such steps have occurred. It simply means no public confirmation exists yet that describes specific actions taken by the organization.
Affected individuals should watch for official communication directly from Andrews Advisory Group LLC. If the company does confirm an incident, it would typically be expected to notify affected patients and offer guidance, and possibly identity protection services, depending on what the investigation finds.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Anyone who believes they may have interacted with Andrews Advisory Group LLC should check their credit reports regularly. You can request free reports from each of the three major credit bureaus annually through AnnualCreditReport.com. Reviewing these reports helps you catch unfamiliar accounts or inquiries early.
In addition, consider spacing out your free reports throughout the year rather than requesting all three at once. This way, you maintain near-continuous visibility into your credit file. If you notice anything suspicious, report it to the relevant bureau immediately.
Consider a Fraud Alert or Credit Freeze
Because the claimed data includes names and dates of birth, placing a fraud alert on your credit file is a reasonable precaution. A fraud alert requires lenders to take extra steps to verify your identity before extending credit. This can slow down identity thieves attempting to open new accounts in your name.
For stronger protection, you can also place a credit freeze with each bureau. A freeze restricts access to your credit file entirely, which makes it much harder for anyone to open new credit accounts using your information. While a freeze is more restrictive, it also offers the highest level of protection against new-account fraud.
Protect Against Medical Identity Fraud
Since the claim involves patient medical and ocular history, affected individuals should review any insurance statements closely. Look for services or claims you do not recognize, as these could indicate medical identity fraud. If you spot anything unusual, contact your insurer right away.
Furthermore, consider requesting a copy of your medical records from any provider connected to this incident. Reviewing these records can help you confirm their accuracy. This is especially important because fraudulent medical activity can sometimes lead to incorrect information appearing in your own health file.
Stay Alert for Phishing Attempts
Criminals often use stolen personal information to craft convincing phishing emails or phone calls. Because names, birth dates, and medical details may have been exposed, scammers could reference these specifics to appear legitimate. Always verify the sender before clicking links or sharing information.
As a precaution, avoid providing personal or financial details to anyone who contacts you unexpectedly. Instead, contact the organization directly using a verified phone number or website. This simple habit can prevent many common phishing schemes from succeeding.
Consult a Data Breach Attorney
If you believe you were affected by this incident, speaking with a data breach attorney can help clarify your options. Many offer free consultations to review your situation and explain whether you may qualify for compensation. This is particularly relevant if the claims about exposed medical records are later confirmed.
Moreover, an attorney can help you understand filing deadlines and any potential class action proceedings. Because laws vary by state, professional guidance ensures you do not miss an important opportunity to seek recourse.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.