A ransomware group claims it stole patient lab requisitions, billing records, and Medicare subscriber details from Arthritis Center of Riverside, a California rheumatology practice. The practice has not confirmed the incident. Affected patients should monitor credit reports, watch insurance statements for fraud, and consider a credit freeze while more details emerge.
| Company | Arthritis Center of Riverside |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Patient Names, Dates of Birth, Home Addresses, Medicare Subscriber Details, Account Numbers, Insurer Information, Billing Records |
| People Affected | Not Publicly Disclosed |
| Attack Method | Ransomware |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Arthritis Center of Riverside Data Breach?
A ransomware group has claimed responsibility for stealing data from Arthritis Center of Riverside, a rheumatology practice based in Riverside, California. The claim appeared on the group’s leak site, which lists the practice among its targets and states that payment was not made.
According to the listing, the stolen files include scanned laboratory requisitions tied to named patients, spanning April through October 2026. The same post references billing and accounts receivable records. As a result, the claim suggests the intrusion may have unfolded over several months before any public disclosure.
At this time, Arthritis Center of Riverside has not publicly confirmed the incident. Because this information comes from an extortion group’s own posting rather than a company statement, the full scope of any forensic investigation remains unknown. Therefore, readers should treat the details below as reported claims, not verified facts, until the practice issues its own notification.
Who was affected?
The leak site post centers on patients of Arthritis Center of Riverside, a rheumatology practice serving the Riverside, California area. Because the listed records include lab requisitions and billing files, the people named in those documents would likely be current or former patients of the practice.
The exact number of affected individuals has not been publicly disclosed. In addition, it is not yet clear whether employees of the practice are included among those potentially impacted. Given the mention of Medicare subscriber details, it is possible that older patients make up a notable portion of those named in the claimed data.
What Information Was Potentially Exposed?
The ransomware group’s posting describes several categories of patient and billing information allegedly taken from the practice. Because this is an unconfirmed claim, the list below reflects what the group says it obtained, not information the practice has verified.
- Patient names
- Dates of birth
- Home addresses
- Medicare subscriber details
- Account numbers
- Insurer information
- Billing and accounts receivable records
- Patient correspondence related to billing
If accurate, this combination of data could create real risk for affected patients. Names paired with dates of birth and addresses give scammers enough detail to impersonate victims convincingly. Meanwhile, Medicare subscriber information is particularly valuable to criminals because it can be used to submit fraudulent medical claims or obtain services in a patient’s name.
Billing and insurance details add another layer of concern. For instance, account numbers and insurer information could be used to redirect payments or file false claims. Because medical identity theft can be harder to detect than ordinary financial fraud, patients may not notice a problem until they receive an unexpected bill or an insurance denial for care they never received.
What is the company doing?
Arthritis Center of Riverside has not publicly confirmed this incident. As a result, there is no public statement describing an investigation, containment steps, or notification plans from the practice itself.
Because the claim originates solely from a ransomware group’s leak site, it remains unclear whether the practice has engaged forensic investigators or law enforcement. Patients who are concerned about their information should watch for an official notification letter from the practice. In the meantime, affected individuals can take independent precautions described below while more details become available.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Affected patients should request a free copy of their credit report and review it closely for unfamiliar accounts or inquiries. You can get free reports from each of the three major credit bureaus through AnnualCreditReport.com.
Checking reports regularly makes it easier to catch fraud early. Because identity thieves sometimes wait months before using stolen data, ongoing monitoring over the next year is a wise precaution, not just a one-time check.
Consider a Fraud Alert or Credit Freeze
Given that addresses and dates of birth were allegedly included in the stolen files, placing a fraud alert with one of the credit bureaus is a reasonable step. This alert requires lenders to verify your identity before opening new credit in your name.
For stronger protection, you might also consider a credit freeze, which blocks most new credit applications entirely. Although a freeze takes a few extra steps to lift when you need credit, it offers the most reliable defense against new-account fraud.
Watch for Medical Billing and Insurance Fraud
Because Medicare subscriber details and insurance information were reportedly included, patients should review any Medicare summary notices or insurance explanation-of-benefits statements carefully. Look for services or claims you do not recognize.
If you spot anything unusual, contact your insurer or Medicare right away. In addition, keep records of your communications in case you need to dispute a fraudulent claim later.
Stay Alert for Phishing Attempts
Scammers often use information from breaches to craft convincing phishing emails, texts, or phone calls. Be cautious of any message claiming to be from the practice, an insurer, or Medicare that asks for personal or payment details.
Instead of clicking links in unexpected messages, contact the organization directly using a phone number you look up independently. This simple habit can prevent most phishing attempts from succeeding.
Consult a Data Breach Attorney
If you believe your information was included in this incident, speaking with a data breach attorney can help you understand your options. Many offer free consultations and can evaluate whether you may be eligible for compensation.
Because laws around data breach claims can be time-sensitive, it is worth seeking advice sooner rather than later. An attorney can also help you track any official notification or class action developments tied to this incident.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.