Orthopedics & Sports Medicine Owensboro, P.S.C., operating as Advanced Center for Orthopedics & Sports Medicine, disclosed a data breach exposing patients’ Social Security numbers and health records. The number of people affected has not been publicly disclosed. Affected individuals should immediately monitor their credit reports and consider placing a fraud alert or credit freeze given the sensitivity of the exposed data.
| Company | Advanced Center for Orthopedics & Sports Medicine |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Social Security Numbers, Health Records |
| People Affected | Not Publicly Disclosed |
| Attack Method | Unspecified/Unauthorized Access |
| Regulators Notified | Delaware Attorney General, Vermont Attorney General, Washington State Attorney General |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Advanced Center for Orthopedics & Sports Medicine Data Breach?
Orthopedics & Sports Medicine Owensboro, P.S.C., doing business as Advanced Center for Orthopedics & Sports Medicine, has confirmed a data breach involving sensitive patient information. The practice filed formal notice of the incident with the Vermont Attorney General in August 2026. This filing revealed that unauthorized parties may have accessed files containing Social Security numbers and health records.
The exact discovery date of the breach has not been publicly disclosed. However, regulatory filings show that the organization has notified multiple state attorneys general about this incident, including agencies in Delaware, Washington, and Vermont. Because these filings span several months, the full timeline of the intrusion and the practice’s response remains only partially clear from public records.
As a result of the discovery, the practice appears to have launched an investigation into the scope of the exposure. In addition, it worked to determine exactly which patient records were affected. Investigations of this kind typically involve forensic specialists who examine network activity to identify what data was accessed and when. While specific technical details about the attack method have not been released, the filing confirms that patient data was compromised.
Who was affected?
The breach appears to primarily affect patients of Orthopedics & Sports Medicine Owensboro and its Advanced Center for Orthopedics & Sports Medicine brand. Because this is a medical practice, those affected likely include individuals who received orthopedic or sports medicine care through the organization. Anyone whose personal or medical information was stored in the practice’s systems could be at risk.
The exact number of individuals affected has not been publicly disclosed. However, the fact that notifications were filed with attorneys general in multiple states suggests the breach may extend beyond a single state’s patient population. This means people who live outside the practice’s immediate service area could also be impacted, particularly if they received treatment while traveling or were referred from another provider.
It is also worth noting that healthcare breaches often affect a broad range of ages, since orthopedic and sports medicine practices commonly treat both younger athletes and older patients recovering from injuries or surgery. Consequently, the affected population could include minors as well as adults, though no specific breakdown has been shared publicly.
What Information Was Potentially Exposed?
According to the breach notification, two categories of sensitive data were involved in this incident. These categories represent some of the most valuable and sensitive types of personal information that a healthcare provider can hold.
- Social Security Numbers
- Health Records
The exposure of Social Security numbers is particularly concerning because this number often serves as a master key to a person’s financial identity. Criminals can use a stolen Social Security number to open new credit accounts, file fraudulent tax returns, or apply for loans in someone else’s name. Unlike a password, a Social Security number cannot simply be changed, which means the risk from this type of exposure can persist for years.
Health records carry their own distinct risks. For example, exposed medical information can be used to commit medical identity theft, where a criminal uses someone else’s identity to obtain treatment, prescriptions, or medical equipment. This type of fraud can also corrupt a victim’s own medical history, potentially leading to incorrect treatment decisions down the road. Because health records often reveal diagnoses and treatment history, their exposure can also lead to privacy harms beyond financial fraud.
What is the company doing?
In response to the breach, Orthopedics & Sports Medicine Owensboro filed official notifications with state regulators, including the Vermont Attorney General. This step is a legally required part of responding to a confirmed data breach involving personal information. The practice also filed notices with the Delaware Attorney General and the Washington State Attorney General regarding this and related incidents.
Beyond regulatory filings, organizations facing this type of breach typically take additional remediation steps. These often include reviewing and strengthening network security controls, working with cybersecurity specialists, and notifying affected individuals directly by mail. While the source material does not detail every specific protective measure offered, patients who receive a notification letter should read it closely for information about any credit monitoring or identity protection services that may be available to them.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Affected individuals should start by requesting free copies of their credit reports from all three major credit bureaus. Reviewing these reports carefully can help you spot new accounts or credit inquiries that you did not authorize. Because identity thieves sometimes wait months before using stolen data, it is important to check your reports regularly rather than just once.
In addition, consider setting up ongoing credit monitoring if it is not already offered to you. Many monitoring services send alerts when new accounts are opened in your name. This early warning can help you respond quickly before fraud spreads further.
Consider a Fraud Alert or Credit Freeze
Because Social Security numbers were involved in this breach, placing a fraud alert or credit freeze on your credit file is a strong protective step. A fraud alert requires lenders to verify your identity before opening new credit in your name. A credit freeze goes further by blocking most access to your credit file entirely.
To set up either protection, you will need to contact each of the three major credit bureaus directly. While a credit freeze offers stronger protection, it also requires you to lift it temporarily whenever you apply for new credit yourself. Either option can significantly reduce the risk of someone opening fraudulent accounts using your stolen information.
Protect Against Medical Identity Theft
Since health records were also exposed in this breach, affected individuals should watch closely for signs of medical identity theft. This means reviewing statements from your health insurance provider, sometimes called explanation of benefits notices, for treatments or services you did not receive. If you notice anything unfamiliar, contact your insurer immediately.
Furthermore, request a copy of your medical records periodically to confirm they accurately reflect your treatment history. If fraudulent information has been added to your file, correcting it early can prevent complications with future medical care. Keeping a personal log of your treatments and visits can also make it easier to identify discrepancies.
Stay Alert for Phishing Attempts
Following any healthcare data breach, scammers often use stolen information to craft convincing phishing emails, texts, or phone calls. These messages may pretend to be from your healthcare provider, an insurance company, or even a government agency. Because the scammers may already know some of your real personal details, their messages can seem legitimate at first glance.
As a result, you should never click links or provide personal information in response to unexpected messages. Instead, contact the organization directly using a phone number or website you know to be authentic. If something feels urgent or too good to be true, it is worth pausing and verifying before responding.
Consult a Data Breach Attorney
Given that this breach involved highly sensitive Social Security numbers and health records, affected individuals may want to speak with an attorney who focuses on data breach cases. An attorney can help you understand your legal rights and whether you may qualify for compensation. Many offer free initial consultations to evaluate your specific situation.
Moreover, acting sooner rather than later can matter, since legal claims related to data breaches are often subject to filing deadlines. A qualified attorney can walk you through what documentation to gather and what steps to take next. This guidance can be especially valuable if you experience actual financial or medical harm as a result of this breach.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.
More Information
Official data breach notification report (PDF) from Delaware Attorney General
View the public data breach notification listing from Vermont Attorney General
Official data breach notification report (PDF) from Washington State Attorney General