HealthConsent
Active breach tracker Lorton, VA Disclosed January 10, 2026

Avosina Healthcare Solutions Data Breach 2026 (Qilin Ransomware): 44,425 Patients Across DC Metro Providers Exposed. 24 Months IDX Monitoring. What To Do

Avosina Healthcare Solutions, a Virginia-based medical billing business associate serving 160+ providers across 30+ DC metro practices, disclosed in January 2026 a July 2025 Qilin ransomware attack. 44,425 individuals affected. 24 months IDX credit monitoring + $1M identity theft insurance offered. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated Sources & methodology

Timeline

Jul 29, 2025

Unauthorized access discovered

Jul 29, 2025

Attacker gained access

Aug 7, 2025

Qilin posts Avosina on Tor leak site with sample documents

Sep 29, 2025

Avosina notifies downstream client SomnoSleep Consultants

Jan 9, 2026

Individual notification letters mailed

Jan 10, 2026

Filed with HHS OCR

Data exposed

03

Contact & insurance

Phishing + targeted scams

Full name Home address Medical information Health insurance information Insurance account balance Medical procedure codes

Class actions filed by

These firms have publicly announced investigations. You may be eligible to join. We are not a law firm and cannot give legal advice.

The Lyon Firm (publicly investigating) Federman & Sherwood (publicly investigating)
If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

01

Accept credit monitoring

It’s the floor of the response. Take it.

02

Freeze your credit

Free at Equifax, Experian, TransUnion.

03

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

04

Review your EOBs

Insurance statements catch medical identity theft early.

05

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

Avosina Healthcare Solutions (operating as Avosina Medical Technologies) is a Lorton, Virginia-based medical billing, revenue-cycle management, and IT services business associate. Founded in 2015 by Dr. Alidad Arabshahi and Dr. Pratik Desai, Avosina serves more than 160 healthcare providers across 30+ practices in the DC metro area, processing approximately $20 million per month in healthcare charges.

On July 29, 2025, Avosina discovered unauthorized access to its network. The Qilin ransomware-as-a-service group (Russia-linked, also known as Agenda) posted Avosina on its dark-web leak site on August 7, 2025, with sample documents including a payslip, medical intake form, contract, invoice, and medical report. Avosina restored from backups and reportedly did not pay the ransom.

On September 29, 2025, Avosina notified its downstream client SomnoSleep Consultants. Avosina filed with HHS OCR on January 10, 2026 (44,425 affected) and with the Maine, New Hampshire, and Vermont AGs on January 12-14. State-specific counts: 16 ME residents, 13 NH residents.

What was stolen

  • Full name, home address
  • Medical information
  • Health insurance information (account balance, procedure codes)

The exposed dataset is narrower than most BA breaches because it was sourced from an “archived” data system rather than live EHR. SomnoSleep’s own EHR was not compromised.

Who is affected (downstream entities)

Only SomnoSleep Consultants, LLC (ENT / sleep medicine, Annandale and Springfield, VA) has been publicly named as a downstream covered entity. Avosina’s 160+ provider client list is otherwise undisclosed in public reporting. If you have received care from a DC metro area provider since 2018, your data may have been processed by Avosina without you knowing the company name.

What Avosina is offering

  • 24 months of complimentary credit monitoring through IDX
  • $1 million identity theft insurance
  • Enrollment deadline: April 9, 2026
  • Contact: Dulcie Miller, 571-481-2455

What to do

  1. Enroll in IDX before the April 9, 2026 deadline.
  2. Place free credit freezes at all three bureaus.
  3. Watch for downstream-provider notification letters. If you received care in the DC metro area from a small or mid-size practice, your provider may notify you separately as Avosina works through its 160+ client list.
  4. Stop the ongoing flow of your billing and clinical data. HealthConsent files HIPAA restriction requests so the demographic and treatment-context data exposed in this breach is not continuously re-shared by downstream entities.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.