How do I know if I am affected by the Aligned Orthopedic Partners data breach?

Aligned Orthopedic Partners is mailing notification letters directly to affected individuals. If you have received care or services from Aligned Orthopedic Partners (also operating as ASC Ortho Management Company, LLC) in the period leading up to April 2026 and you have not received a letter, contact the entity directly. 7,213 individuals were confirmed affected in the HHS OCR filing.

Was Aligned Orthopedic Partners attacked by a ransomware group?

No threat actor has publicly claimed responsibility for the Aligned Orthopedic Partners breach. The incident is categorized in the HHS OCR portal as a phishing.

What is HealthConsent and how does it help with the Aligned Orthopedic Partners breach?

HealthConsent is an independent health-data privacy service. We help affected individuals stop the ongoing flow of their health information by filing HIPAA restriction requests, FTC Health Breach Notification Rule deletion requests, and state-law deletion requests across providers, insurers, Health Information Exchanges, prescription networks, and data brokers. Credit monitoring offered by Aligned Orthopedic Partners addresses identity-theft risk; HealthConsent addresses the longer-tail problem of your exposed health data continuing to be sold and shared by other entities downstream.

Active breach tracker Bethesda, MD Disclosed April 17, 2026

Aligned Orthopedic Partners Data Breach 2026: 7,213 DC/MD/VA Orthopedic Patients Exposed via Email Compromise. What To Do

Q: What data was exposed in the Aligned Orthopedic Partners breach?

According to the notification letter and supporting filings, the compromised data included: Full name, Date of birth, Social Security number, Driver's license / state ID number, Medicaid / Medicare number, Financial account number, Health insurance information, Patient account number, Medical record number, Dates of service, Provider name, Mental / physical condition, Diagnosis, treatment, clinical information, Prescription information.

Q: Should I file a lawsuit over the Aligned Orthopedic Partners data breach?

3 plaintiffs' firms have publicly announced investigations or filed complaints related to the Aligned Orthopedic Partners breach: Shamis & Gentile P.A. (publicly investigating), Zimmerman Reed (publicly investigating), Bryson Harris Suciu & DeMay (publicly investigating). We are not a law firm and cannot give legal advice; consult your own attorney to evaluate your options.

ASC Ortho Management Company, LLC (d/b/a Aligned Orthopedic Partners), a Bethesda, Maryland orthopedic management services organization (MSO), disclosed in April 2026 a November-December 2025 email environment compromise exposing names, Social Security numbers, driver's licenses, Medicare/Medicaid IDs, financial accounts, and clinical narratives for 7,213 patients across DC/MD/VA orthopedic practices. 12 months Cyberscout (TransUnion) offered. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated May 15, 2026 Sources & methodology

Timeline

Nov 16, 2025

Unauthorized access to corporate email environment begins

Dec 8, 2025

Unusual activity detected; forensic investigators engaged

Feb 17, 2026

Data review completed identifying impacted individuals

Apr 17, 2026

Individual notification letters mailed; substitute notice posted; PRNewswire release issued

Apr 17, 2026

Disclosed publicly

Nov 16, 2025

Unauthorized access to corporate email environment begins

Dec 8, 2025

Unusual activity detected; forensic investigators engaged

Feb 17, 2026

Data review completed identifying impacted individuals

Apr 17, 2026

Individual notification letters mailed; substitute notice posted; PRNewswire release issued

Apr 17, 2026

Disclosed publicly

Data exposed

High-risk identity

Enables financial + identity theft

Date of birth Social Security number Driver's license / state ID number

Health records

Don't expire and can't be reissued

Medical record number Diagnosis, treatment, clinical information Prescription information

Contact & insurance

Phishing + targeted scams

Full name Medicaid / Medicare number Financial account number Health insurance information Patient account number Dates of service Provider name Mental / physical condition

Class actions filed by

These firms have publicly announced investigations. You may be eligible to join. We are not a law firm and cannot give legal advice.

Shamis & Gentile P.A. (publicly investigating) Zimmerman Reed (publicly investigating) Bryson Harris Suciu & DeMay (publicly investigating)

If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

Accept credit monitoring

It’s the floor of the response. Take it.

Freeze your credit

Free at Equifax, Experian, TransUnion.

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

Review your EOBs

Insurance statements catch medical identity theft early.

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

ASC Ortho Management Company, LLC (doing business as Aligned Orthopedic Partners) is a Bethesda, Maryland orthopedic management services organization (MSO) founded in 2018. The corporate entity provides administrative, billing, and HR services for a network of affiliated orthopedic and sports-therapy practices across DC, Maryland, and Virginia.

Between November 16 and December 16, 2025, an unauthorized actor accessed the corporate email environment. ASC Ortho detected unusual activity on December 8, 2025 and engaged third-party cybersecurity investigators. The data review concluded on February 17, 2026, identifying 7,213 affected individuals. ASC Ortho mailed individual notification letters and posted a substitute notice on April 17, 2026.

This is a classic management-services-organization (MSO) failure mode: a single email-environment compromise at the corporate tier exposes patient data across the full downstream practice network.

No ransomware group has publicly claimed responsibility. No leak-site listing has been observed.

What was stolen

The compromised mailbox cluster contained an unusually broad set of data fields:

Full name, date of birth
Social Security number
Driver’s license / state ID number
Medicaid / Medicare number
Financial account number
Health insurance information, patient account number, medical record number
Dates of service, provider name
Mental / physical condition; diagnosis, treatment, and clinical information
Prescription information

The combination of SSN + financial account + clinical narrative is a high-tier identity-theft and medical-identity-theft exposure profile.

What Aligned Orthopedic Partners is offering

Complimentary identity-protection through Cyberscout (TransUnion)
Enrollment deadline: July 16, 2026
Dedicated call center: 1-833-877-6247 (Monday to Friday, 8 a.m. to 8 p.m. Eastern)

What to do

Enroll in Cyberscout through the activation code in your letter. Don’t wait — the deadline is July 16, 2026.
Place free credit freezes at Equifax, Experian, TransUnion. Full SSN is in scope.
File IRS Form 14039 (Identity Theft Affidavit).
Cancel and reissue any payment cards that may be tied to financial account information.
Watch your insurance Explanation of Benefits statements for unfamiliar orthopedic claims.
Stop the ongoing flow of your orthopedic treatment data. HealthConsent files HIPAA restriction requests so the surgical, diagnostic, and prescription data exposed in this breach is not continuously re-shared.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.