Think Big Health Care Solutions, a practice management vendor for Optimotion Orthopaedics, notified individuals in October 2026 that a cybersecurity event may have exposed their names, claims information, medical record numbers and procedure codes. The total number affected has not been disclosed. Affected individuals should enroll in the free Cyberscout credit monitoring offered using the code in their letter within 90 days.
| Company | Think Big Health Care Solutions |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Name, Claims Information, Medical Record Number, Procedure Codes |
| People Affected | Not Publicly Disclosed |
| Attack Method | Unspecified/Unauthorized Access |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewThink Big Health Care Solutions has notified people about a cybersecurity event affecting files and emails connected to one of its clients. This Think Big Health Care Solutions data breach involves a practice management firm that works behind the scenes with medical offices. As a result, people who never directly dealt with the company are now receiving breach letters in the mail.
What Happened in the Think Big Health Care Solutions Data Breach?
Think Big Health Care Solutions sent notice letters dated October 9, 2026, telling recipients about a cybersecurity event that may have exposed some of their personal information. The company provides billing, contracting and credentialing services to medical practices. One of its clients is Optimotion Orthopaedics, and the affected files and emails are tied to that relationship.
The notification letter does not say when the event actually took place. It also does not explain how an intruder got into the company’s systems, nor how long any unauthorized access may have lasted. Because of this, the exact timeline of the incident remains unclear to the public.
A copy of the letter was filed with the Massachusetts Attorney General’s office in October 2026 as part of that state’s public breach notification process. Massachusetts law requires organizations to report incidents involving residents’ personal information to both the affected people and state regulators. However, filing in one state does not mean the event was limited to that state’s residents.
According to the letter, Think Big responded by securing its systems and launching an investigation into what happened. The company also reviewed all data that may have been at risk in order to identify the specific people involved. This process is what led to the October 2026 notification being sent out.
Who was affected?
The people affected by this incident are connected to Optimotion Orthopaedics, a medical practice that relies on Think Big for administrative services. Because patients typically have no direct relationship with a billing or practice management vendor, many recipients may not immediately recognize the company that sent them a letter.
The notification does not state a total number of people affected. Therefore, the full scope of this event has not been publicly disclosed. In addition, because service providers like Think Big often support practices in multiple states, the number of people affected nationally could be larger than what any single state filing reflects.
It is not yet known whether the affected population includes minors, though pediatric or family practice patients are sometimes swept into incidents involving billing vendors. Anyone who has received care through Optimotion Orthopaedics, or who has had claims processed by Think Big, should treat a received letter seriously.
What Information Was Potentially Exposed?
According to the notice letter, Think Big’s review identified specific categories of information in the affected files and emails. This data is primarily health-related rather than financial in nature. The letter does not mention Social Security numbers or financial account details as part of this particular incident.
- Name
- Claims information
- Medical record number
- Procedure codes
This combination of data can reveal meaningful details about a person’s medical history. For example, procedure codes indicate what type of care someone received, while a medical record number links that information directly to a specific patient file. As a result, this type of exposure carries real privacy concerns even without financial account numbers involved.
Because health details were exposed, affected individuals may face a higher risk of targeted phishing attempts. Scammers could use real claims or procedure information to make fraudulent messages seem legitimate. In addition, this type of data can potentially be used in medical identity fraud, where someone uses another person’s identity to obtain care or submit false claims.
Even though financial account numbers were not identified in this incident, exposed health information still deserves close attention. Medical identity fraud can be harder to detect than standard financial fraud. This is because it often shows up first on an insurance statement rather than a bank or credit card record.
What is the company doing?
Think Big says it took several steps after discovering the cybersecurity event. The company secured its systems, investigated the incident and reviewed data to determine exactly whose information may have been involved. It also says it reviewed its internal security policies and procedures following the event.
In addition, Think Big reports that it conducted additional staff training and put further technical safeguards in place. The company also says it notified law enforcement, and that the notification process was not delayed by any law enforcement investigation. Think Big states that it is not aware of any actual or attempted misuse of the exposed information so far.
As a precautionary measure, Think Big is offering affected individuals single-bureau credit monitoring, along with a credit report and credit score, at no cost. These services come with fraud alerts for 24 months and are provided through Cyberscout, a TransUnion company. Recipients must use the unique code in their own letter to enroll within 90 days of the letter date, since the company says it cannot enroll people automatically.
What Should Affected Individuals Do?
Enroll in the Free Credit Monitoring Offer
If you received a letter from Think Big Health Care Solutions, take time to read it closely. It contains a unique enrollment code for the free Cyberscout credit monitoring service, and that code only works for 90 days from the letter date.
Because enrollment is not automatic, missing this window means losing access to the free protection. Setting a reminder to sign up soon after receiving the letter is a simple way to avoid missing the deadline entirely.
Watch for Signs of Medical Identity Fraud
Since claims information and medical record numbers were involved, it is wise to review explanation of benefits statements from your health insurer closely. Look for any services, procedures or visits listed that you do not recognize.
In addition, compare these statements against your own records of recent care. If something looks unfamiliar, contact your insurer and provider right away. Catching unauthorized claims early can prevent larger billing disputes down the road.
Consider a Fraud Alert or Credit Freeze
Although Social Security numbers were not listed in this incident, placing a free fraud alert or security freeze with Equifax, Experian and TransUnion still adds a layer of protection. This step makes it harder for anyone to open new credit accounts in your name.
You can also request free credit reports at annualcreditreport.com to check for unfamiliar accounts. Reviewing these reports periodically, even after an initial check, helps you catch problems that might develop over time.
Stay Alert for Phishing Attempts
Because this incident involved health-related details, scammers may use that information to craft convincing phishing messages. Be cautious of any email, text or phone call that references your medical care or insurance claims.
Never click links or share personal details in response to unexpected messages, even if they appear to reference accurate information about your care. Instead, contact your provider or insurer directly using a number you already trust, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
Understand Your Legal Options
If you received a notice from Think Big Health Care Solutions, you may have legal options worth exploring. Companies that manage patient information are expected to protect it, and failures to do so can sometimes lead to legal accountability.
Speaking with a data breach attorney can help clarify whether you qualify for compensation. Many consultations are free, so there is little downside to asking questions about your specific situation.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.