On Demand Occupational Medicine, an Ohio-based occupational health provider, suffered a ransomware attack claimed by a group calling itself Wallstreet. The breach may have exposed patient health records, drug testing results, and personal identifying information. The number of affected individuals has not been publicly disclosed. Anyone who used this provider should monitor their credit reports and watch for official notification letters.
| Company | On Demand Occupational Medicine |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Full Names and Contact Information, Dates of Birth, Social Security Numbers, Employment Information, Drug Testing Results, Medical Examination Records, Health Insurance Details |
| People Affected | Not Publicly Disclosed |
| Attack Method | Ransomware |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the On Demand Occupational Medicine Data Breach?
On Demand Occupational Medicine, a provider of occupational health, drug testing, workplace safety, and employee wellness services based in Austintown, Ohio, has confirmed it was the target of a ransomware attack. A group calling itself Wallstreet has claimed responsibility for the intrusion. This means the attackers likely accessed internal systems before deploying ransomware or attempting extortion.
Details about the exact timeline remain limited. The breach discovery date has not been publicly disclosed. However, ransomware attacks like this one typically involve attackers gaining unauthorized access to a network, moving through systems undetected, and then locating and copying sensitive files before triggering encryption or making extortion demands.
As a result of the attack, an investigation into the scope of the incident is now underway. Because On Demand Occupational Medicine handles occupational health and employment-related medical information, forensic teams are likely working to determine exactly which files and records the attackers accessed. This process often takes weeks or months to complete fully.
Who Was Affected?
The breach may affect individuals who received occupational health screenings, drug testing, or workplace wellness services through On Demand Occupational Medicine. This can include current and former employees of client companies who were referred to the provider for testing or evaluations.
The exact number of affected individuals has not been publicly disclosed. Because the company serves employers across a range of industries, the population involved could span multiple workplaces and communities. In addition, employees of On Demand Occupational Medicine itself may also be impacted if internal personnel records were stored on the compromised systems.
Given the nature of occupational health services, it’s possible that both adults and, in some cases, younger workers undergoing pre-employment screening could be part of the affected group. Anyone who used this provider for a workplace medical exam or drug test should consider themselves potentially affected until more specific information becomes available.
What Information Was Potentially Exposed?
Because On Demand Occupational Medicine operates in the healthcare sector and provides drug testing and employee wellness evaluations, the data it stores likely includes sensitive personal and medical details. While the full scope of the exposure has not been confirmed publicly, the categories of information typically held by this type of provider include the following.
- Full names and contact information
- Dates of birth
- Social Security numbers
- Employment and employer information
- Drug testing results
- Medical examination records
- Workplace injury or wellness program records
- Health insurance details
If Social Security numbers or medical records were indeed part of this breach, affected individuals face a real risk of identity theft. Criminals can use stolen Social Security numbers to open new credit accounts, file fraudulent tax returns, or apply for loans in someone else’s name. This kind of fraud can take months to detect and even longer to fully resolve.
In addition, exposed medical and drug testing records carry their own distinct risks. Health information can be used for medical identity theft, where someone uses a victim’s identity to obtain treatment or prescriptions. Because drug test results and workplace health data are sensitive, their exposure could also lead to embarrassment, discrimination, or misuse by bad actors targeting specific individuals.
What Is the Company Doing?
In response to the attack, On Demand Occupational Medicine is reportedly investigating the incident to determine which systems and records were affected. Ransomware incidents of this kind typically involve bringing in cybersecurity specialists to contain the threat and assess the extent of unauthorized access.
Ongoing steps likely include restoring affected systems, strengthening network defenses, and reviewing which specific individuals had their data compromised. As the investigation continues, affected individuals should watch for official notification letters from the company describing the exposure and any protective services being offered, such as credit monitoring or identity theft protection.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Anyone potentially affected by this breach should regularly check their credit reports for unfamiliar accounts or inquiries. You can request free credit reports from all three major bureaus through AnnualCreditReport.com.
Because identity thieves often wait months before using stolen information, ongoing monitoring is important. Consider checking your reports at least every few months over the next year, rather than just once.
Consider a Fraud Alert or Credit Freeze
Given that Social Security numbers may have been exposed, placing a fraud alert or credit freeze with the three credit bureaus is a strong protective step. A fraud alert requires lenders to verify your identity before opening new credit, while a freeze blocks new accounts entirely.
To set up a freeze, you’ll need to contact Equifax, Experian, and TransUnion individually. This process is free and can be lifted temporarily whenever you need to apply for credit yourself.
Protect Against Medical Identity Theft
Because health and drug testing records may have been involved, it’s wise to review any medical bills or insurance statements for services you don’t recognize. Medical identity theft can result in incorrect information appearing in your health records, which may affect future care.
If you notice unfamiliar charges or claims, contact your health insurance provider immediately. Requesting a copy of your medical records periodically can also help you catch discrepancies early.
Stay Alert for Phishing Attempts
After a healthcare data breach, criminals often follow up with phishing emails or phone calls pretending to be from the breached company or a credit monitoring service. Be cautious of any unsolicited messages asking for personal information.
Instead of clicking links in unexpected emails, go directly to the official website of the organization in question. If you receive a suspicious call claiming to be from On Demand Occupational Medicine, hang up and verify through a known contact number.
Consult a Data Breach Attorney
If you believe your information was compromised in this incident, speaking with a data breach attorney can help you understand your legal options. Many attorneys offer free case evaluations for individuals affected by healthcare data breaches.
Because laws around data breach notification and compensation vary, an attorney can clarify what remedies may be available to you. This is especially useful if you experience financial losses or fraud tied to this breach.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.