Bardmoor Cancer Center Data Breach 2025: 991 Affected · Hacking/IT Incident · FL. Filed With HHS OCR. What To Do.

Bardmoor Cancer Center, a Largo, Florida oncology practice owned by Integrated Oncology Network (ION, a Cardinal Health subsidiary), filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on June 27, 2025, reporting 991 affected individuals in a Hacking/IT Incident at the email vector. The Bardmoor filing is one of more than two dozen filings tied to a single late-2024 phishing intrusion at ION’s shared corporate email and SharePoint environment, which collectively affected over 117,000 patients across roughly a dozen states.

Timeline

• December 13 to 16, 2024. An unauthorized party gained access to a small number of ION employee email and SharePoint accounts. ION later characterized the activity as a sophisticated phishing scheme.
• May 9, 2025. ION concluded the forensic review of the compromised accounts and identified the patient records present in them.
• June 13, 2025. ION notified the affected oncology practices, including Bardmoor Cancer Center, of the breach and the patient records identified.
• June 27, 2025. Bardmoor Cancer Center filed its breach report with HHS OCR listing 991 affected individuals, and ION began mailing individual notification letters to patients on Bardmoor’s behalf.

What was exposed

The compromised email and SharePoint accounts contained a mix of demographic, financial, insurance, and clinical data. The categories ION has publicly disclosed include:

• Names, addresses, and dates of birth
• Social Security numbers (for a subset of affected individuals)
• Financial account information
• Health insurance and claims information
• Diagnoses, laboratory results, medications, treatment information, and dates of treatment
• Healthcare provider names

Exact data elements vary by individual; the personal notification letter sent to each affected patient lists the specific fields involved for that person.

Why oncology data is especially sensitive

Cancer-treatment records sit at the high end of the sensitivity spectrum. A leaked oncology record can include the type and stage of cancer, biopsy and pathology findings, chemotherapy or radiation regimens, and clinic visit dates. Beyond the standard identity-theft and medical-fraud risks that follow any breach of names, Social Security numbers, and insurance data, oncology-specific disclosures carry distinct downstream harms: employment and insurance discrimination concerns under conditions that may predate a person’s public discussion of their diagnosis, unwanted contact by predatory “alternative treatment” marketers, and family-member exposure when records reference hereditary cancer testing. Patients who had not yet told employers, extended family, or insurers about a diagnosis lose control of that disclosure timing.

What is being offered

ION arranged complimentary credit monitoring, dark web monitoring, and identity restoration services for affected individuals. The enrollment instructions and access code are included in the personal notification letter mailed beginning June 27, 2025. ION has stated that its investigation found no evidence of misuse of patient information; the monitoring is offered as a precautionary measure.

Class-action activity

At least one plaintiffs’ firm, Strauss Borrelli PLLC, has publicly announced an investigation into the Bardmoor Cancer Center breach and is soliciting affected individuals. No filed complaint naming Bardmoor Cancer Center is on the public record as of the date this page was last updated. Broader plaintiffs’ activity tied to the ION incident, including the parent network and other affected practices, is also under way.

What to do if you may be affected

• Enroll in the credit monitoring offered through your notification letter. The enrollment window is time-limited, and the dark-web monitoring component is the part most relevant when Social Security numbers are involved.
• Freeze your credit with Equifax, Experian, and TransUnion in addition to enrolling in monitoring. A freeze is free, takes about ten minutes per bureau, and stops new accounts from being opened in your name even if your data is misused later.
• Watch your Explanation of Benefits statements from health insurers for visits or procedures you do not recognize. Medical identity theft tends to surface in claims data before it surfaces anywhere else.
• Keep the notification letter. It lists the specific data elements exposed for you, which is the document plaintiffs’ counsel, your insurer, and the IRS will ask for if you later need to prove standing or dispute a fraudulent claim.
• Be cautious with follow-up contact purporting to come from Bardmoor Cancer Center, ION, or the credit-monitoring vendor. Confirm any phone number or link against the notification letter itself before responding.

Sources on this page

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach (filed June 27, 2025; 991 affected; Email; Healthcare Provider; Florida).
• HIPAA Journal — Phishing Attack Affects Multiple Cancer Treatment Centers — corroborates the December 13 to 16, 2024 intrusion window, the ION parent-organization context, the data elements exposed, and the complimentary credit/identity monitoring offer.
• GovInfoSecurity — Email Hack Affects at Least 24 Cancer Care Practices — corroborates the May 9, 2025 investigation conclusion and the June 13, 2025 practice-notification date, and names Bardmoor Cancer Center among the Florida practices affected.
• DataBreaches.Net — Integrated Oncology Network phishing attack coverage — additional independent reporting on the ION-wide incident.
• Strauss Borrelli PLLC — Bardmoor Cancer Center Data Breach Investigation — confirms plaintiffs’-firm interest specific to Bardmoor Cancer Center and the Largo, Florida location detail.