Docs Medical Group, Inc. dba Pulse Urgent Care Data Breach 2025: 4,035 Affected · Hacking/IT Incident · CA. Filed With HHS OCR. What To Do.

Docs Medical Group, Inc., the Redding, California operator of Pulse Urgent Care, filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on December 28, 2025, reporting 4,035 affected individuals. The clinic detected suspicious activity on its network in late March 2025, and the Medusa ransomware group subsequently claimed responsibility on its dark-web leak site and demanded a $120,000 ransom. Substitute notice was issued on December 29, 2025.

Timeline

• March 24, 2025 — Pulse Urgent Care detected suspicious activity on its network and contained the intrusion.
• November 26, 2025 — Forensic review completed; the entity identified the specific individuals and data elements involved.
• December 26, 2025 — Notification letter dated and provided to regulators (California Attorney General copy filed on this date).
• December 28, 2025 — HHS OCR breach report posted listing 4,035 affected individuals, “Hacking/IT Incident,” Network Server.
• December 29, 2025 — Substitute notice published via PR Newswire; individual notification letters mailed to those with addresses on file.
• January 5, 2026 — Cole & Van Note publicly announces a class-action investigation on behalf of affected patients.

Exposed data

Per the entity’s own notice, the data elements that may have been involved vary by individual and include name; date of birth; Social Security number; driver’s license number; passport number; clinical or treatment information including lab results, prescription information, and provider information; and health insurance information.

The combination of Social Security number, government ID number, and clinical detail is high-severity. Driver’s license and passport numbers, in particular, enable synthetic-identity fraud that credit monitoring alone does not detect.

What Pulse Urgent Care is offering

Eligible individuals are offered 12 months of complimentary credit monitoring and identity-theft protection through TransUnion, with a 90-day enrollment window from receipt of the notification letter. The entity has stood up a dedicated call center at 1-833-303-4915, staffed Monday through Friday, 8:00 a.m. to 8:00 p.m. Eastern.

Class-action posture

Cole & Van Note, a California consumer-protection class-action firm, announced an investigation on January 5, 2026, and has since closed intake on this matter (“THIS INVESTIGATION IS NO LONGER ACCEPTING NEW CLIENTS”), which typically signals that a complaint has been filed or that the firm has consolidated its client roster ahead of filing. Additional plaintiffs’ firms commonly file parallel actions for breaches of this size in California state and federal court.

What to do if you may be affected

• Enroll in the TransUnion offer before the 90-day deadline. It is free and does not waive any legal claims.
• Freeze your credit with Equifax, Experian, and TransUnion. A freeze is free, takes about ten minutes per bureau, and is materially more protective than monitoring alone against new-account fraud.
• If your driver’s license or passport number was listed in your individual notice, contact the California DMV and the U.S. Department of State respectively to flag the document and request guidance on replacement.
• Watch for medical-identity misuse. Review your explanation-of-benefits statements from health insurers for services you did not receive. Medical identity theft is harder to detect than credit fraud and is not surfaced by standard credit monitoring.
• Keep the notification letter. If a class action is certified, the letter will be the simplest proof of class membership.

Sources on this page

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach.
• Pulse Urgent Care substitute notice (PR Newswire, Dec. 29, 2025) — the entity’s own published notice with dates and offered services.
• Regulatory notification letter filed with the California Attorney General — the December 26, 2025 letter as filed with the CA AG.
• Comparitech reporting on the Medusa ransomware attack — corroborates the Medusa attribution and $120,000 ransom demand.
• HIPAA Journal coverage of five-provider cyber incidents — trade-press summary including this incident.
• Cole & Van Note class-action investigation announcement — the plaintiffs’ firm’s public filing notice.