Center for Urologic Care of Berks County Data Breach 2025: 543 Patients Exposed. SSNs, Diagnoses, Medical Images. What To Do.

What happened

Center for Urologic Care of Berks County, PC (CUC) is a single-specialty urology practice based in Wyomissing, Pennsylvania, serving patients throughout Berks County and the surrounding Reading region. On or about September 28, 2025, the practice detected suspicious activity on its IT systems and engaged third-party forensic experts. The investigation determined that an unauthorized third party had accessed files on CUC’s network between September 24 and October 13, 2025.

Between September 28 and November 6, 2025, CUC completed its document review and identified the affected individuals and the specific data elements involved. On November 26, 2025, CUC filed the incident with the U.S. Department of Health and Human Services Office for Civil Rights, reporting 543 affected individuals, and began mailing individual notification letters. Law enforcement was notified.

The OCR portal classifies the incident as a Hacking/IT Incident at a Network Server. CUC has not publicly attributed the intrusion to a named threat actor or ransomware group, and no dark-web leak of CUC data has been reported as of this writing.

Timeline

• September 24, 2025: Unauthorized access to CUC’s network begins.
• September 28, 2025: CUC detects suspicious activity, secures systems, and engages forensic investigators.
• October 13, 2025: Unauthorized access window ends.
• September 28 to November 6, 2025: Document review determines the files contained protected health information and identifies the 543 affected individuals.
• November 26, 2025: CUC files with HHS OCR and begins mailing notification letters.

What was exposed

The compromised files contained, depending on the individual:

• Full name
• Date of birth
• Address
• Social Security number
• Government-issued ID number
• Doctor / provider name
• Diagnosis information
• Prescribed medications
• Test results
• Medical images
• Care and treatment details

Because CUC is a single-specialty urology practice, the diagnosis, medication, test-result, and medical-imaging categories are likely to include urology-specific clinical detail — for example incontinence, erectile dysfunction, prostate or bladder cancer, kidney stones, fertility, and other stigma-sensitive conditions. Combined with Social Security numbers, the dataset supports both financial identity theft and highly targeted medical phishing.

What CUC is offering

• Complimentary identity monitoring services for affected individuals (provider and enrollment duration are not publicly disclosed in the press releases reviewed; consult your individual notification letter for the enrollment code and provider).
• Dedicated incident response line: 1-800-405-6108, Monday through Friday, 8 a.m. to 8 p.m. Eastern.

Class-action investigation

Srourian Law Firm, APC has publicly announced it is investigating a potential class action on behalf of affected individuals. As of this writing, no class-action complaint has been confirmed filed in court. Additional plaintiffs’ firms commonly file in 543-person urology breaches; this section will be updated as filings appear on the public docket.

What to do if you may be affected

1. Watch for your notification letter. It will list the specific data elements exposed in your record and the enrollment instructions for the complimentary identity-monitoring service.
2. Place free credit freezes at Equifax, Experian, and TransUnion. This is the single highest-leverage step against new-account identity theft.
3. File IRS Form 14039 (Identity Theft Affidavit) if you are concerned about fraudulent tax filings tied to your Social Security number.
4. Be alert to targeted phishing. With urology-specific diagnosis and prescription detail in the dataset, scammers can craft uniquely convincing emails, calls, and physical mailings referencing your real care history.
5. Stop the ongoing flow of your urology data. HealthConsent files HIPAA restriction requests so the diagnosis and prescription data exposed in this breach is not continuously re-shared by downstream entities.
6. Call CUC’s response line at 1-800-405-6108 if you do not receive a letter and believe you may be affected.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2025 healthcare data breaches

Sources on this page

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach.
• Claim Depot: Center for Urologic Care Data Breach Coverage — incident summary including access window, data elements, and response steps.
• Srourian Law Firm: CUC Breach Investigation — class-action investigation page.
• My Data Breach Attorney: CUC Case Page — independent plaintiffs’-bar case page.
• Center for Urologic Care of Berks County (practice website) — entity website.