Metro Tulsa Foot & Ankle Specialist filed a breach notification in October 2026 confirming that patient Social Security numbers, financial account codes, card details, and health records were involved in a data breach. The number of people affected has not been publicly disclosed. Affected patients should monitor credit reports, consider a credit freeze, and watch for medical identity theft.
| Company | Metro Tulsa Foot & Ankle Specialist |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Social Security Numbers, Financial Account Codes, Credit and Debit Account Information, Health Records |
| People Affected | Not Publicly Disclosed |
| Attack Method | Unspecified/Unauthorized Access |
| Regulators Notified | Vermont Attorney General |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Metro Tulsa Foot & Ankle Specialist Data Breach?
Metro Tulsa Foot & Ankle Specialist recently disclosed a data breach that compromised sensitive patient information. The practice filed a formal notification with the Vermont Attorney General’s office in October 2026. This filing confirmed that unauthorized parties had accessed files containing protected personal and medical data.
The specific date the breach was discovered has not been publicly disclosed. However, the notification itself was filed in October 2026, which means affected patients are only now learning the details. As a result, many questions about the exact timeline remain unanswered in public records.
Details about the attack method, such as whether it involved ransomware, a phishing scheme, or another form of unauthorized access, were not specified in the filing. Nevertheless, the practice’s decision to notify a state attorney general indicates it completed some form of internal investigation first. This step is typically required before an organization can determine which data categories were affected and who needs to be notified.
Because this is a healthcare provider, any breach involving patient files raises particular concern. Medical practices often store years of sensitive records for each patient. Consequently, a breach at a small specialty clinic can still expose a significant volume of deeply personal information.
Who was affected?
The individuals affected by this breach are most likely current and former patients of Metro Tulsa Foot & Ankle Specialist. Because the practice is based in Tulsa, Oklahoma, the bulk of those affected are probably Oklahoma residents. However, the filing with Vermont’s Attorney General suggests at least one Vermont resident was also impacted, which is why that state required notice.
The exact number of people affected by this breach has not been publicly disclosed. In addition, the filing does not specify whether employees, in addition to patients, had their information compromised. Given that medical practices treat patients of all ages, it is possible that minors who received care at the clinic could also be among those affected.
What Information Was Potentially Exposed?
According to the breach notification, several categories of highly sensitive data were involved in this incident. This is a healthcare data breach, so the exposed information includes both financial and medical details. Below is the list of data categories confirmed in the filing.
- Social Security numbers
- Financial account codes
- Credit and debit card account information
- Health records
This combination of data creates considerable risk for identity theft. For example, a criminal who has a Social Security number paired with financial account codes can attempt to open new credit lines or access existing accounts. Because this is such a complete data set, it is more dangerous than a breach involving only one category of information.
In addition, the exposure of health records introduces the risk of medical identity theft. This occurs when someone uses stolen information to obtain medical services, prescriptions, or insurance payouts under another person’s name. As a result, affected individuals should watch not only their bank statements but also their medical and insurance records for unfamiliar activity.
What is the company doing?
Metro Tulsa Foot & Ankle Specialist responded to the breach by filing a formal notification with state regulators. Specifically, the practice filed notice with the Vermont Attorney General in October 2026. This filing is a required legal step whenever a breach affects a resident of that state, regardless of where the breached organization is located.
Beyond the regulatory filing, the publicly available details do not specify every remediation step the practice has taken. Many healthcare providers in this situation strengthen network security, reset account credentials, and work with forensic specialists following a breach of this kind. Affected patients should watch for a direct notification letter, since such letters often explain what protective services, if any, are being offered.
What Should Affected Individuals Do?
Monitor Your Credit Reports Closely
Anyone whose Social Security number was exposed should check their credit reports regularly. You can request a free copy from each of the three major credit bureaus once a year. Reviewing these reports helps you catch new accounts or inquiries that you did not authorize.
Because this breach involved both SSNs and financial account codes, ongoing monitoring is especially important. Consider spacing out your free reports throughout the year so you have continuous visibility. If you notice unfamiliar activity, report it to the credit bureau immediately and file a dispute.
Place a Fraud Alert or Credit Freeze
Given that financial account information and Social Security numbers were involved, placing a fraud alert is a smart precaution. A fraud alert requires lenders to take extra steps to verify your identity before approving new credit. This can slow down a criminal trying to open accounts in your name.
For stronger protection, you might consider a full credit freeze instead. A freeze restricts access to your credit file entirely, which makes it much harder for anyone to open new accounts. While a freeze requires you to lift it temporarily when you need credit yourself, it offers the most robust defense against identity theft.
Watch for Medical Identity Theft
Because health records were part of this breach, affected patients should also monitor their medical and insurance accounts. Request an explanation of benefits statement from your insurer and review it for services you did not receive. This simple habit can help you catch medical identity theft early.
In addition, contact your healthcare providers if you notice any unfamiliar diagnoses or treatments listed in your records. Correcting a medical record that has been altered by fraud can take time, so acting quickly is important. Keeping copies of your medical history before and after the breach can also help resolve disputes faster.
Stay Alert for Phishing Attempts
After a breach like this, scammers often use stolen information to craft convincing phishing emails or phone calls. Be cautious of anyone who contacts you claiming to be from the clinic, your bank, or a credit agency asking for personal details. Legitimate organizations rarely ask for sensitive information through unsolicited messages.
Instead of responding directly to a suspicious message, contact the organization using a phone number or website you already know is legitimate. This simple verification step can prevent you from giving away additional personal details. If you do receive a notification letter about this breach, read it carefully, since it may contain specific instructions.
Consider Consulting a Data Breach Attorney
Given the sensitive nature of the data involved, including Social Security numbers and health records, affected individuals may want to speak with an attorney who focuses on data breach cases. An attorney can help you understand whether you qualify for compensation. This is especially relevant if you experience financial losses or spend significant time resolving identity theft issues.
Many data breach attorneys offer a free initial case evaluation, so there is typically no upfront cost to learn your options. Because deadlines for filing claims can vary, it is wise to act sooner rather than later. This ensures you do not miss any applicable filing window.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.
More Information
View the public data breach notification listing from Vermont Attorney General