Apex Custom Software Data Breach 2025: 1,500 Affected · Ransomware/Supply-Chain Attack on Texas Healthcare Software Vendor. What To Do.

Apex Custom Software, a Texas-based software developer that builds applications for the healthcare sector — including Controlled Substance Monitoring Program (CSMP) tooling used by pharmacies and healthcare clients — was breached on January 16, 2025 by a threat actor that calls itself 0mid16B. As a HIPAA Business Associate, Apex filed a breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on January 22, 2025, reporting 1,500 affected individuals in a Network Server incident. Because Apex’s software sits inside multiple covered entities, the 1,500-person figure is widely reported as an interim count and may not capture the full downstream exposure across Apex’s client base.

Timeline

• January 16, 2025 — 0mid16B compromises Apex Custom Software’s environment in what reporting describes as a supply-chain attack on the healthcare software vendor.
• January 18, 2025 — Latest timestamp visible on data the attacker later publishes, per DataBreaches.net.
• January 20, 2025 — 0mid16B tweets publicly that a U.S. healthcare software provider has been hacked, claims server data has been deleted, and gives a 48-hour deadline before publishing data.
• January 22, 2025 — Apex Custom Software files its HIPAA breach notification with HHS OCR as a Business Associate, listing 1,500 affected individuals and Network Server as the location of the breached information.
• January 29, 2025 — Attacker claims to still have access to Apex’s network and that data has been exfiltrated; a ransom demand is issued.
• January 30, 2025 — DataBreaches.net publishes exclusive reporting on the incident, including a sample of leaked Apex Controlled Substance software and what appears to be Cardinal Health employee credentials, some in plaintext, that were stored or accessible through Apex.

What was exposed

The HHS OCR portal entry lists Network Server as the location of breached protected health information and identifies the event as a Hacking/IT Incident affecting 1,500 individuals. Specific data elements have not yet been itemized publicly in the OCR record.

According to reporting from DataBreaches.net and HIPAA Journal, the attacker’s own claims and leak samples suggest the breach reached beyond Apex’s own corporate data:

• Source code and database contents tied to Apex’s Controlled Substance Monitoring Program software.
• User credentials and access details linked to Apex’s downstream healthcare clients.
• Apparent employee information — including some passwords in plaintext — that the attacker attributes to Cardinal Health, one of Apex’s pharmacy-distribution-sector clients.

These attacker-side claims have not been independently confirmed by Apex Custom Software or by Cardinal Health on the record, and the OCR filing is the only government-confirmed data point as of this update.

Credit monitoring / what Apex is offering

Apex Custom Software has not posted a substitute breach notice or detailed remediation offering on a public-facing notice page as of this update. Because Apex filed as a Business Associate, individual notification letters to affected patients are expected to be issued by the covered entities Apex serves, not by Apex directly. Any complimentary credit-monitoring or identity-restoration services should appear in those covered-entity letters when they arrive.

Class-action status

No class-action lawsuit has been publicly filed against Apex Custom Software as of May 16, 2026. There is a separate and unrelated 2024 incident involving Apex Global Solutions (a different Texas-headquartered healthcare IT vendor, ~390,000 patients) which reached a final-approval settlement on May 1, 2026 — do not conflate the two. The Apex Custom Software incident remains in OCR’s “under investigation” tranche.

What to do if you may be affected

The 1,500-person figure in the OCR record is an early count tied to one or a small number of downstream client relationships. The realistic exposure is broader if you are a pharmacy customer, clinical employee, or patient whose data flowed through Apex’s CSMP tooling at any of its clients in late 2024 or early 2025.

• Freeze your credit with Equifax, Experian, and TransUnion. It is free, takes about ten minutes per bureau, and is the single highest-leverage step against identity theft.
• Watch your prescription history. If your covered entity or pharmacy used Apex’s controlled-substance monitoring tooling, identity-theft risk is layered with the secondary risk of fraudulent prescription activity in your name. Pull your prescription history through your insurer or pharmacy portal and review for anything you do not recognize.
• Watch for a notification letter from your healthcare provider or pharmacy, not from Apex directly. As a Business Associate, Apex’s downstream covered-entity clients are the ones obligated to send individual HIPAA breach notifications. Read any letter carefully — it will list the specific data elements exposed and any complimentary credit-monitoring being offered.
• If you are a Cardinal Health employee whose credentials appeared in the leaked sample, rotate those passwords and any reused passwords on personal accounts immediately, and enable multi-factor authentication everywhere it is supported.
• Bookmark this page. We update it as Apex Custom Software, its covered-entity clients, the Texas Attorney General’s office, or HHS OCR publish further information.

Sources on this page

• HHS Office for Civil Rights Breach Portal — federal regulatory record of this breach (filed January 22, 2025; 1,500 individuals; Hacking/IT Incident; Network Server).
• DataBreaches.net — Exclusive: Apex Custom Software hacked, threat actors threaten to leak the software — primary investigative reporting on the 0mid16B intrusion, timeline, and leaked-sample analysis.
• HIPAA Journal — Hackers Breach Systems of HIPAA-Regulated Entities in Missouri, Nevada, Texas & Wisconsin — trade-press summary placing Apex within the broader January 2025 healthcare-vendor breach wave.
• Malware.news — Apex Custom Software hacked, threat actors threaten to leak the software — corroborating coverage of the 0mid16B announcement and 48-hour leak threat.