Cunningham Prosthetic Care Data Breach 2026: 2,523 Maine Patients Exposed via Email Compromise. SSN + Driver's License in Scope. What To Do

What happened

Cunningham Prosthetic Care LLC is a family-owned prosthetic and orthotic (P&O) practice at 180 Main Street, Saco, Maine, opened in February 2019. The practice serves York County, Cumberland County, and southern New Hampshire. Services include custom-fabricated artificial limbs (limb-loss solutions), skeletal and lower-extremity orthotic bracing, and off-the-shelf bracing.

On October 22, 2025, Cunningham Prosthetic Care detected suspicious activity in an employee email account and engaged external cyber-forensic investigators. On March 4, 2026, the investigation confirmed the email account contained patient PHI. On May 1, 2026, Cunningham Prosthetic Care mailed notification letters and filed with HHS OCR — confirming 2,523 affected individuals.

The pattern (single employee mailbox, no ransomware indicators) is consistent with business email compromise — opportunistic credential phishing or token theft. No ransomware group has publicly claimed responsibility. No leak-site listing has been observed.

Time from discovery to notification: ~191 days. From determination of breach (March 4) to notice (May 1): ~58 days, within HIPAA’s 60-day clock.

What was stolen

Per the breach notice:

• Full name
• Date of birth
• Social Security number
• Driver’s license number
• Medical record number
• Diagnostic information
• Medical treatment information
• Health insurance information

The notice qualifies that not every data type was exposed for every individual. The combination of SSN + driver’s license + clinical data is a high-tier identity-theft exposure profile.

What Cunningham Prosthetic Care is offering

Public reporting does not confirm a complimentary credit monitoring program. Given the SSN and driver’s license exposure, the industry standard would be 12-24 months of monitoring. Read your specific notification letter carefully — the offer (if any) and call center number will be listed there.

If you do not find credit monitoring referenced in your letter, request it directly.

What to do

1. Read your specific notification letter to confirm what data elements were involved in your case and what (if any) credit monitoring is offered.
2. Enroll in monitoring if offered through the activation code in your letter.
3. Place free credit freezes at Equifax, Experian, TransUnion. Full SSN and driver’s license are in scope.
4. File IRS Form 14039.
5. Replace your driver’s license if you receive evidence of identity theft using it.
6. Stop the ongoing flow of your prosthetic and orthotic data. HealthConsent files HIPAA restriction requests so the limb-fit, prosthetic-spec, and amputation-context data exposed in this breach is not continuously re-shared with insurers and referral networks.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches