Apex Spine & Neurosurgery Data Breach 2026 (Interlock Ransomware): 2,500 Georgia Patients Exposed. 20 GB Claimed. What To Do

What happened

Apex Spine & Neurosurgery, LLC is a Georgia neurosurgery and minimally invasive spine practice founded around 2020. The practice operates three locations in Suwanee (454 Satellite Blvd, Ste 100), Columbus (500 18th St, Ste B20), and Bethlehem (426 Exchange Blvd, Ste 500). Surgeons listed: Robert Ayer MD FAANS, Dave Seecharan MD FAANS, Bethwel Raore MD FAANS, and Mairaj Sami MD. Specialties include spine surgery, cranial and brain procedures (tumors, hydrocephalus, trigeminal neuralgia), spinal decompression and fusion, neuro-oncology, peripheral nerve, MVA injury, and pain management.

On December 9, 2025, an unauthorized actor accessed Apex’s network and copied files. On December 23, 2025, Apex discovered ransomware encryption of files. On January 6, 2026, the Interlock ransomware group posted Apex Spine & Neurosurgery to its dark-web leak site, claiming 20 GB of exfiltrated data.

Apex issued a “Notice of Cybersecurity Event” on its website on February 5, 2026 and filed with HHS OCR on February 6, 2026 — confirming 2,500 affected individuals.

Apex confirms encrypted data was recovered from backups, and the EMR was on a logically separate network and unaffected. This is meaningful — the exfiltrated 20 GB does not include the practice’s electronic medical records.

Interlock is a ransomware group that CISA and the FBI flagged in a joint 2025 advisory for accelerated healthcare targeting.

What was stolen

Per the entity’s notice:

• Full name, home address, phone, date of birth
• Social Security number
• Driver’s license number, passport number, other government IDs
• Location of service, dates of service
• Treatment / condition information, diagnosis codes
• Prescription information
• Medical history
• Assigned physician names
• Financial account numbers (without CVV/PIN)
• Patient account numbers
• Health insurance subscriber / ID numbers

The combination of SSN + driver’s license + passport + financial account is a high-tier identity-theft exposure profile.

What Apex is offering

HIPAA Journal reports Apex is offering free credit monitoring services. Vendor, duration, call-center number, and enrollment-code details are not yet visible in public reporting (the February 5, 2026 PDF on apexspineandneuro.com should list these specifics).

Read your specific notification letter for activation details.

What to do

1. Read your specific notification letter and enroll in the offered credit monitoring through the activation code.
2. Place free credit freezes at Equifax, Experian, TransUnion. Full SSN, driver’s license, and passport are all in scope.
3. File IRS Form 14039.
4. Cancel and reissue any payment cards that may be tied to financial account information.
5. Replace your passport if you receive evidence of identity theft using it.
6. Watch your insurance Explanation of Benefits statements for unfamiliar neurosurgery or pain-management claims.
7. Stop the ongoing flow of your spine and neurosurgery data. HealthConsent files HIPAA restriction requests so the surgical, diagnostic, and prescription data exposed in this breach is not continuously re-shared.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches