BMG of Kansas Data Breach 2026 (Qilin Ransomware): 1,327 Employee Health Plan Members Exposed. Manufacturing Company. What To Do

What happened

BMG of Kansas, Inc. is not a medical practice. It is a family-owned contract metal manufacturer at 606 Commerce Drive in Hesston, Kansas (Harvey County, approximately 30 miles north of Wichita). Founded in 1985, the company has approximately 70 employees and operates a 50,000+ sq ft facility producing sheet metal, plate, extruded aluminum, and CNC laser/welding components for recreational equipment, lawnmowers, farm equipment, and truck beds.

BMG appears on the HHS OCR portal because it operates a self-sponsored employee group health plan — a HIPAA covered entity. The 1,327-person count vastly exceeds BMG’s ~70 employees, indicating the affected population includes employees + dependents + former employees / COBRA participants over years.

Between October 5 and 8, 2025, an unauthorized actor accessed BMG’s network. On November 10, 2025, the Qilin ransomware group posted BMG of Kansas to its Tor dark-web leak site. BMG’s forensic team confirmed the determination on January 14, 2026, and BMG filed with HHS OCR on February 26, 2026 — confirming 1,327 affected individuals.

Qilin (also known as Agenda) is a Russian-linked ransomware-as-a-service group operating a double-extortion model. The group was publishing 40+ victims per month in late 2025.

Why this is a HIPAA breach

BMG of Kansas is not a healthcare provider, but the group health plan it sponsors for its employees is a HIPAA-covered entity. The breach affected the plan’s records — health insurance enrollment, dependent rosters, and any medical or claims information processed for plan administration.

What was stolen

Per the entity’s notice (varies by individual):

• Full name
• Date of birth
• Social Security number
• Driver’s license / state ID number
• Financial account information
• Medical information
• Health insurance information

What BMG of Kansas is offering

• Experian credit monitoring, 12 months minimum, free
• Dedicated call center: 1-833-745-0867 (Monday to Friday, 8 a.m. to 8 p.m. Central)
• Engagement number: B160360
• Remediation: additional EDR, managed monitoring / threat response, full password reset, rebuilt affected servers

State AG filings noted in the notice

BMG’s notification letter explicitly addresses residents in:

• District of Columbia
• Iowa
• New Mexico
• Maryland
• New York
• North Carolina
• Oregon
• Rhode Island (approximately 28 RI residents specifically called out)

What to do

1. Enroll in Experian credit monitoring through the activation code in your letter (engagement number B160360).
2. Place free credit freezes at Equifax, Experian, TransUnion. Full SSN and driver’s license are in scope.
3. File IRS Form 14039.
4. Cancel and reissue any payment cards tied to financial account information.
5. Replace your driver’s license if you receive evidence of identity theft using it.
6. If you are a former BMG employee or COBRA participant, your records were almost certainly in scope — current employment status does not exclude you.
7. Stop the ongoing flow of your group-health-plan data. HealthConsent files HIPAA restriction requests covering self-sponsored employer health plan administration pathways.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches