Academic Urology & Urogynecology of Arizona Data Breach 2026 (INC RANSOM): 73,281 Patients Exposed. Sensitive Urology Records. What To Do

What happened

Academic Urology & Urogynecology of Arizona (AUUA) is a multi-clinic urology and urogynecology group operating as the urology division of Palo Verde Hematology and Oncology, Ltd. (PVHO). AUUA has seven Arizona locations: Anthem, Buckeye, Phoenix, Sun City, Sun City West, Litchfield Park, and Wickenburg.

Between May 18 and May 22, 2025, an unauthorized third party accessed AUUA’s network. AUUA detected the intrusion on May 22, contained it the same day, and engaged a third-party forensic firm. On June 17, 2025, the INC RANSOM ransomware-as-a-service group claimed responsibility on its dark-web leak site, posting AUUA as a victim.

The forensic review concluded on January 30, 2026 that protected health information had been accessed. AUUA mailed individual notification letters and posted a substitute notice on February 12, 2026, filed with the Vermont Attorney General the same day, and filed with the HHS Office for Civil Rights on February 13, 2026 — confirming 73,281 affected individuals.

State filings disclose 6 Maine residents, 2 New Hampshire residents, and 4 Rhode Island residents.

What was stolen

The compromised data is unusually broad and clinically sensitive:

• Full name, date of birth
• Social Security number
• Account / routing numbers (banking)
• Medical record number and patient account number
• Mental and physical condition, diagnosis, and diagnosis code
• Treatment location and procedure type
• Provider name
• Dates of service
• Prescription information
• Insurance group, claim, subscriber, and member numbers

The Vermont AG filing additionally references driver’s license, government ID, passport, tribal ID, digital signatures, tax ID / IP PIN, payment card data, lab results, medications, and claims / appeals history. Confidence on the broader Vermont list is medium (it may reflect maximum-possible categories rather than per-record exposure).

Given AUUA’s specialty (urology, urogynecology), the diagnosis and procedure categories may include incontinence, pelvic-organ prolapse, erectile dysfunction, prostate cancer, bladder cancer, fertility, and sexual-dysfunction treatment data. These are particularly stigma-sensitive and discrimination-relevant categories.

What AUUA is offering

• 12 months of complimentary credit monitoring and identity-theft protection via Experian IdentityWorks for individuals whose SSN was involved
• Enrollment open through May 12, 2026
• Dedicated response line: (833) 353-3172 (Monday to Friday, 6 a.m. to 6 p.m. Pacific)

What to do

1. Enroll in Experian IdentityWorks before the May 12, 2026 deadline.
2. Place free credit freezes at Equifax, Experian, and TransUnion.
3. File IRS Form 14039 to prevent fraudulent tax filings.
4. Cancel and reissue any bank cards that may be tied to the account / routing numbers in your AUUA billing records.
5. Be alert to highly targeted phishing. With urology-specific diagnoses and prescription info in the dataset, scammers can craft uniquely convincing outreach.
6. Stop the ongoing flow of your urology data. HealthConsent files HIPAA restriction requests so the diagnosis and prescription data exposed in this breach is not continuously re-shared by downstream entities.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches