Cary Pediatric Center Data Breach 2025: NC Pediatric Practice Reports Hacking Incident · Qilin Leak-Site Listing · What Parents Should Do

What happened

Cary Pediatric Center, PA is a Wake County, North Carolina pediatric practice with three offices: the flagship at 1001 Crescent Green in Cary, plus locations in Apex and Fuquay-Varina. Because the practice serves infants, children, and adolescents, the affected population is overwhelmingly minor patients and their parents or guardians.

According to the practice’s own Notice of Data Security Incident, Cary Pediatric detected on or about September 19, 2025 that an unauthorized third party attempted to infiltrate its network environment. The practice engaged outside forensic specialists and, after investigation, concluded that the unauthorized actor “may have compromised certain personal information.” The practice states the affected data was limited to recorded audio calls to and from patients and the office, and that electronic medical records were not impacted.

The incident was reported to the U.S. Department of Health and Human Services Office for Civil Rights, where it appears on the public breach portal under category “Hacking/IT Incident — Network Server.”

On January 17, 2026, the Qilin ransomware-as-a-service group added Cary Pediatric Center to its data-leak site, indicating exfiltration and a failed or refused ransom negotiation. The entity has since published its public Notice of Data Security Incident and is mailing individual notification letters.

Timeline

• September 19, 2025 — Intrusion detected; incident response begins
• November 17, 2025 — Reported to HHS Office for Civil Rights (Hacking/IT Incident, Network Server)
• January 17, 2026 — Qilin ransomware group posts Cary Pediatric Center to its leak site
• February 19, 2026 — Public Notice of Data Security Incident published; individual letters mailed

What information was exposed

Per the entity notice, potentially exposed elements were:

• Full name
• Date of birth
• Protected health information contained in recorded calls between patients (or guardians) and the practice

The practice emphasizes that the affected data set was limited to call recordings, that not every individual had all listed elements exposed, and that the electronic medical record system was not compromised. The practice further states it has no evidence of misuse as of the notice date.

A note on the sensitive population: pediatric patients

Even when exposure is “limited,” a child’s name plus date of birth is the seed of a synthetic-identity-theft kit. A child’s credit file is normally blank, which makes it attractive to fraudsters who can pair a real name and real DOB with a fabricated Social Security number, open accounts, and run the scheme for years before the child applies for a first job or first credit card.

If the audio recordings included parents reading back insurance numbers, addresses, or other identifiers (routine in pediatric scheduling and billing calls), the practical exposure is broader than the headline data list. Treat this as a higher-sensitivity event than the entity’s reassurances suggest, and freeze your child’s credit at all three bureaus regardless of whether the letter says the Social Security number was confirmed exposed.

What Cary Pediatric is offering

• Complimentary credit monitoring and identity-theft protection services
• 12-month coverage period
• Enrollment instructions included in the individual notification letter
• Call center: 855-522-4713, Monday through Friday, 8 a.m. to 8 p.m. ET

The 12-month single-tier offer is below industry norm for breaches involving minor PHI, where multi-year (often 24-month) monitoring with identity-restoration support is standard.

Class action status

Ahdoot & Wolfson, PC has publicly opened a class action investigation against Cary Pediatric Center. As of this writing, the firm’s page describes a possible class action that is still under investigation. No complaint has been publicly filed by this firm. Affected parents and guardians who choose to participate in litigation should preserve their notification letter, the envelope, and any communications from Cary Pediatric.

What to do (parent or guardian)

1. Freeze your child’s credit at all three bureaus (Equifax, Experian, TransUnion). Minors are entitled to free freezes. Each bureau requires proof of guardianship and a manual submission. This is the single highest-leverage step against synthetic identity theft.
2. Check whether a credit file already exists for your child at annualcreditreport.com. The presence of any file for a minor is itself a red flag.
3. Enroll your child in the 12-month monitoring using the activation code in your letter. Do this even if you doubt exposure.
4. File IRS Form 14039 under your child’s SSN to flag against fraudulent tax-return filings.
5. Save the notification letter and the mailing envelope. These are foundational evidence if you later join a class action or pursue an individual claim.
6. Stop the ongoing flow of your child’s health data. HealthConsent files HIPAA restriction requests on behalf of your minor child so their pediatric records are not continuously re-shared by downstream entities, payers, and HIEs.

Sources

• Cary Pediatric Center — Notice of Data Security Incident — the entity’s primary disclosure (PDF)
• HHS Office for Civil Rights Breach Portal — federal regulatory record (Hacking/IT Incident, Network Server)
• RedPacket Security — Qilin Ransomware Victim: Cary Pediatric Center — leak-site listing dated January 17, 2026
• Ahdoot & Wolfson, PC — Class Action Investigation — plaintiffs’ firm investigation page (investigation only; no complaint publicly filed at this URL as of this writing)
• Cary/Fuquay/Apex Pediatrics — Practice Homepage — entity homepage with link to the data-incident notice