Fieldtex Products Data Breach 2025 (Akira Ransomware): 274,363 Health Plan Members Exposed Across 13 States. What To Do

What happened

Fieldtex Products, Inc. is a Rochester, New York-based contract manufacturer and fulfillment vendor founded in 1973. Its E-First Aid Supplies division ships over-the-counter (OTC) benefit items to health plan members. As a HIPAA business associate, Fieldtex holds names, addresses, dates of birth, member IDs, plan names, plan effective terms, and gender for enrollees across multiple downstream covered entities, including Medicare Advantage and commercial health plans such as AmeriHealth. The company operates a 55,000-square-foot facility and employs over 150 staff.

On August 19, 2025, Fieldtex identified unauthorized access to its computer systems, immediately secured its network, and engaged a third-party forensic investigation team. By September 30, 2025, the review confirmed that protected health information had been accessible to the attacker. On November 5, 2025, the Akira ransomware group claimed responsibility on its Tor-based leak site, alleging exfiltration of roughly 14 GB of data from the E-First Aid Supplies division, including employee, customer, and financial documents.

Fieldtex filed its first HHS OCR breach report on November 20, 2025, covering 238,615 individuals, and posted a substitute notice on its corporate website the same day. On December 3, 2025, Fieldtex filed three additional OCR reports on behalf of separate downstream covered-entity customers, bringing the total publicly disclosed count to at least 274,363 individuals. The company notified at least 13 state attorneys general, with filings documented in California, Iowa, Maine, Massachusetts (December 24, 2025), Montana, Nebraska, New Hampshire, Oregon, Rhode Island, South Carolina, Texas, Vermont, and Washington.

What was stolen

According to Fieldtex’s own notice, corroborated by the South Carolina AG consumer notice letter and trade press reporting, the confirmed exposed data elements are:

• Full name
• Home address
• Date of birth
• Insurance member identification number
• Health plan name
• Plan effective terms
• Gender

No Social Security numbers, financial account numbers, payment card data, or clinical treatment records were identified as exposed by Fieldtex’s forensic review. Fieldtex stated there is no indication the data has been misused; however, Akira’s claim of exfiltration means the data left Fieldtex’s control regardless of observed misuse.

What Fieldtex is offering

Fieldtex arranged 12 months of complimentary credit monitoring through Cyberscout, a TransUnion company, for affected individuals. The enrollment deadline was 90 days from the date of the notification letter (letters were dated December 3, 2025, making the deadline approximately March 3, 2026). That enrollment window has now closed for most recipients.

Contact details for Fieldtex’s dedicated response team:

• Hotline: 833-866-8797, Monday through Friday, 8:00 AM to 8:00 PM Eastern Time (excluding holidays)
• Email: [email protected]
• Mail: Fieldtex Products Inc., c/o Cyberscout, PO Box 1286, Dearborn, MI 48120-9998

Because Fieldtex is a business associate rather than your health plan, your notification letter may arrive on the letterhead of your insurer or benefits administrator. If you received a letter referencing “Fieldtex Products,” “E-First Aid Supplies,” or an over-the-counter benefit fulfillment vendor, this is the incident it relates to.

Class actions

Multiple lawsuits were filed within weeks of the breach disclosure and have since been consolidated before Judge Elizabeth A. Wolford in the Western District of New York.

The lead case is Ruszin v. Fieldtex Products Inc. (Case No. 6:25-cv-06768, WDNY), first filed December 15, 2025 by Mason LLP. On March 17, 2026, Judge Wolford consolidated seven related cases into that docket, terminating the individual actions (25-cv-6778, 25-cv-6799, 25-cv-6811, 25-cv-6817, 25-cv-6827, and 26-cv-6024). The court appointed four firms as Interim Co-Lead Counsel: Mason LLP (Gary E. Mason), Barnow and Associates, P.C. (Ben Barnow), Srourian Law Firm, P.C. (Daniel Srourian), and Israel David LLC (Israel David). Milberg PLLC filed the Stair case (January 7, 2026), which was absorbed into the consolidated proceeding.

On March 31, 2026, plaintiffs filed the Consolidated Amended Complaint on behalf of six named plaintiffs: Robert Ruszin, Pamela Wollenberg, Alegria Clark, Frank Hensley, Justin Stair, and Jessica Clark.

Additional firms that publicly announced investigations but have not appeared in the court docket include Abington Cole + Ellery, Federman & Sherwood, Almeida Law Group, and Cafferty Clobes Meriwether & Sprengel. ClassAction.org closed its investigation in December 2025 without reporting a separately filed case.

Keep your notification letter. It is your proof of class membership if the case is certified and a settlement fund is established.

What to do

1. Place credit freezes at Equifax, Experian, and TransUnion. Freezes are free, reversible, and the highest-leverage protection against new accounts opened with the exposed identity elements.
2. The Cyberscout monitoring enrollment window has closed (deadline was approximately March 3, 2026 for most recipients). If you have not yet enrolled and believe you are still within your letter’s deadline, contact the hotline at 833-866-8797 to confirm your options.
3. Review your insurance Explanation of Benefits for unfamiliar providers or claims. Member ID exposure creates risk of medical identity theft that credit monitoring alone does not catch.
4. Watch your Medicare Summary Notice if you are a Medicare Advantage member. Fraudulent billing under your member ID can appear months after a breach.
5. File IRS Form 14039 if your Social Security number was separately exposed. Fieldtex’s own notice does not confirm SSN exposure, but Akira claimed broad document exfiltration; check your specific notification letter for the confirmed data elements.
6. Keep your notification letter. A consolidated class action is now pending in federal court (Ruszin v. Fieldtex, WDNY). Your notification letter is your proof of class membership and will be required by any settlement claims administrator.
7. Stop the ongoing flow of your health plan member data. HealthConsent files HIPAA restriction requests so the insurance and benefits information exposed in this breach is not continuously re-shared across health plan vendor networks.

Continue reading

• Your HIPAA Rights — what you can demand from covered entities and their business associates
• All tracked healthcare breaches