Allegheny Health Network Home Medical Equipment & Home Infusion Data Breach 2025: 292,773 Patients Exposed via IntraSystems Vendor Hack. What To Do

Allegheny Health Network’s home medical equipment and home infusion subsidiaries notified 292,773 patients on January 17, 2025 that an October 2024 cyberattack on IT vendor IntraSystems, LLC exposed Social Security numbers, financial account numbers, insurance details, diagnoses, and prescription information. This is a business-associate (vendor) breach: the data lived on systems IntraSystems hosted and managed for AHN’s home-care divisions.

Timeline

• October 11, 2024 — An unauthorized third party gains access to IntraSystems-managed systems supporting AHN Home Medical Equipment, LLC and AHN Home Infusion, LLC.
• November 1 to November 8, 2024 — Subsequent forensic review concludes the attacker accessed files containing patient information during this window.
• November 19, 2024 — AHN is informed of the incident. Affected systems are taken offline and connections to other services severed.
• January 17, 2025 — AHN publicly discloses the breach, IntraSystems begins mailing notification letters, and the incident is filed with the HHS Office for Civil Rights at 292,773 affected. AHN also notified the Massachusetts Attorney General on the same date.
• January 24, 2025 — Dimoff v. Allegheny Health Network, No. 2:25-cv-00125, filed in the U.S. District Court for the Western District of Pennsylvania. A separate class action against IntraSystems LLC directly (named plaintiff: David Couchenour) is filed the same day in the U.S. District Court for the District of Massachusetts, where IntraSystems is headquartered.
• March 3, 2025 — Related federal class actions consolidated.
• March 31, 2025 — Judge J. Nicholas Ranjan appoints Benjamin F. Johns of Shub Johns & Holbrook as interim co-lead counsel for the consolidated action.
• April 30, 2025 — Court-ordered deadline for plaintiffs to file a consolidated amended complaint in the W.D. Pa. proceedings.

What was exposed

Per AHN’s public statement and IntraSystems’ notification letters, the data elements involved may include:

• Full name, date of birth, address
• Social Security number
• Financial account number (AHN states no access codes / PINs were involved)
• Health insurance identification number and other health insurance information
• Diagnoses, provider information, treatments and procedures, dates of service
• Prescription information
• Medical device serial numbers

Because the affected divisions are home medical equipment and home infusion, the treatment and device-serial fields can indicate conditions such as oxygen dependence, sleep apnea, diabetes (insulin pumps / CGMs), wound care, chemotherapy infusion, parenteral nutrition, and other home-administered therapies. AHN has stated it is not aware of any actual misuse of the data as of the public notice.

What AHN is offering

• Complimentary credit monitoring and identity-theft protection services, arranged through IntraSystems, for affected individuals. Trade-press reporting indicates two years of coverage.
• Patients are being notified individually by mail by IntraSystems (not AHN directly), in accordance with HIPAA and applicable state law.
• Enrollment instructions and a dedicated response line are included with the individual notification letters.

Class-action posture

At least seven proposed federal class actions were filed in the weeks following the January 17, 2025 disclosure, in Pennsylvania and Massachusetts federal courts. The cases were consolidated on March 3, 2025, and Benjamin F. Johns of Shub Johns & Holbrook was appointed interim co-lead counsel on March 31, 2025. The lead case is captioned Dimoff v. Allegheny Health Network, No. 2:25-cv-00125 (W.D. Pa.).

Plaintiff firms publicly investigating or pursuing claims include Shub Johns & Holbrook, Strauss Borrelli PLLC, Barnow & Associates, Ahdoot & Wolfson, Sauder Schelkopf, Edelson Lechtzin, Lynch Carpenter, Migliaccio & Rathod LLP, and Kehoe Law Firm. Common allegations: negligence in safeguarding sensitive health and financial information, failure of vendor oversight, and violation of HIPAA-adjacent duties owed to patients.

IntraSystems LLC itself faces parallel litigation. A separate proposed class action (named plaintiff: David Couchenour) was filed January 24, 2025 in the U.S. District Court for the District of Massachusetts directly against IntraSystems, targeting the vendor’s independent security failures rather than AHN’s oversight of its contractor.

What to do

1. Read the IntraSystems notification letter carefully. It will name the specific data elements involved in your file and explain how to enroll in the offered credit monitoring.
2. Place free credit freezes at Equifax, Experian, and TransUnion. A freeze is more protective than monitoring.
3. Enroll in the offered credit monitoring anyway — it costs you nothing and adds a second layer.
4. File IRS Form 14039 (Identity Theft Affidavit) to block fraudulent tax filings tied to your SSN.
5. Cancel and reissue any bank cards or accounts tied to the financial account numbers AHN held on file for your home-care billing.
6. Watch for highly targeted phishing. Attackers who know your diagnosis, device serial, and prescriptions can impersonate AHN, IntraSystems, your DME supplier, or your infusion pharmacy convincingly.
7. Stop the ongoing flow of your health data. HealthConsent files HIPAA restriction requests so the diagnosis and prescription data exposed in this breach is not continuously re-shared by downstream entities.

Sources

• HIPAA Journal coverage of the AHN / IntraSystems breach
• BankInfoSecurity: IT Services Vendor Hack Affects 293,000 AHN Patients
• WPXI Pittsburgh local coverage
• Becker’s Hospital Review
• SecurityWeek summary
• Shub Johns & Holbrook: Interim co-lead counsel appointment
• Strauss Borrelli PLLC investigation page
• AHN Healthcare at Home (parent service line)
• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach.
• Bloomberg Law: IT Vendor IntraSystems Sued Over Breach Exposing Patient Data
• Migliaccio & Rathod LLP: AHN Data Breach Investigation
• Kehoe Law Firm: AHN Data Breach — Massachusetts AG Notification Reported
• WTAE (ABC Pittsburgh): AHN data breach impacts home care patients

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2025 healthcare data breaches