Fort Wayne Medical Education Program Data Breach 2025: 28,502 Affected · INC RANSOM Ransomware · IN. Class Actions Filed. What To Do.

Fort Wayne Medical Education Program (“FWMEP”), a graduate medical-education consortium that runs a dually accredited family-medicine residency and operates an outpatient clinic inside the Lutheran Downtown Medical Office Building in Fort Wayne, Indiana, filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on March 6, 2025, reporting 28,502 affected individuals in a Hacking/IT Incident at Network Server. FWMEP’s own notice and the New Hampshire Attorney General filing later put the impacted population at 29,485 once the document review closed in September 2025. The INC RANSOM ransomware group has claimed the attack on its dark-web leak site and posted what it describes as 66 GB of FWMEP data.

Timeline

• December 12, 2024 — An unauthorized actor first accessed FWMEP’s network, per the entity’s notice of data privacy incident.
• December 17, 2024 — FWMEP detected unusual activity on its network and removed the intruder.
• March 6, 2025 — FWMEP filed the breach with HHS OCR, reporting 28,502 affected individuals (Hacking/IT Incident, Network Server).
• September 9, 2025 — Document review completed; FWMEP confirmed that protected health information and other personal information had been viewed or acquired.
• October 2, 2025 — Individual notification letters began going out by mail, nearly ten months after discovery.
• October 3, 2025 — Breach notice filed with the New Hampshire Attorney General.
• October 6, 2025 — Plaintiff firms including Lynch Carpenter, Strauss Borrelli, and Migliaccio & Rathod publicly announced class-action investigations; HIPAA Times subsequently reported that at least five class actions had been filed.

What was exposed

FWMEP’s notice and the New Hampshire AG filing describe the exposed data elements as varying person by person, but in aggregate spanning the full identity-theft toolkit:

• First and last names
• Social Security numbers
• Driver’s license or state ID numbers
• Passport numbers
• Other government ID numbers
• Dates of birth
• Medical history and treatment information
• Health insurance information
• Medical billing information, including bank account numbers and payment or credit card numbers (CVC codes are not believed to have been involved)

FWMEP is offering at least 12 months of complimentary credit monitoring and identity-protection services through IDX (with enrollment support routed through Haystack) to individuals whose Social Security numbers were involved. A dedicated assistance line is published at 1-833-809-4990.

Who’s notifying you (residency / clinic patient overlap)

This breach is unusual because FWMEP is not a hospital you would normally remember receiving care from. FWMEP is a graduate medical-education consortium — it employs and trains family-medicine residents who rotate through Fort Wayne hospitals and operates its own clinic inside the Lutheran Downtown Medical Office Building. Reporting by local outlet 21Alive News and HIPAA Times confirms the Lutheran Downtown clinic affiliation. No FWMEP source publicly identifies a Parkview affiliation, and we will not assert one without a primary record.

The practical consequence: the population in the breach is broader than just FWMEP’s direct clinic patients. It also covers FWMEP employees and their dependents, and current and former patients who saw a FWMEP-employed resident in a clinical setting. If you received primary care at the Lutheran Downtown Medical Office Building during the years FWMEP operated there, you may be on the notification list even if you never recognized FWMEP as the billing entity.

Class-action posture

At least five putative class actions have been filed against FWMEP, with public investigations announced by Lynch Carpenter LLP, Strauss Borrelli PLLC, and Migliaccio & Rathod LLP within days of the October 2, 2025 notification mailing. Plaintiffs’ core theory is two-pronged:

1. Inadequate safeguards. FWMEP allegedly failed to implement reasonable administrative and technical controls sufficient to keep a ransomware actor out of a network holding Social Security numbers, government IDs, and medical billing data.
2. Notification delay. HIPAA’s Breach Notification Rule generally requires individual notification within 60 days of discovery of a breach. FWMEP discovered the intrusion on December 17, 2024, and did not mail individual notices until October 2, 2025 — roughly 289 days later. Whether the document-review period legally tolled that clock is likely to be a central litigation issue.

We have not yet confirmed the specific case captions or whether the suits will be consolidated in the U.S. District Court for the Northern District of Indiana. We will update this page as PACER filings become publicly indexed.

What to do

If you received care through FWMEP, were employed by FWMEP, or were a dependent of a FWMEP employee:

• Read the notification letter carefully. It lists the exact data elements involved for you specifically and explains how to activate the complimentary IDX monitoring through Haystack. Enrollment is time-limited.
• Freeze your credit with Equifax, Experian, and TransUnion. Because Social Security numbers and government IDs were involved, a credit freeze is the highest-leverage step you can take. It is free and reversible.
• Watch your bank and card statements. Bank account numbers and payment card numbers (excluding CVC codes) were exposed. Set up real-time transaction alerts and review statements through at least mid-2026.
• File a tax-return identity-theft PIN with the IRS (Form 14039 / IP PIN) if your Social Security number was confirmed exposed. This blocks fraudulent returns filed in your name.
• Preserve the letter. If you choose to join one of the pending class actions, the notification letter is the document that establishes you are a class member. Do not throw it away.

Sources

• HHS Office for Civil Rights Breach Portal — federal regulatory record (28,502 affected; Hacking/IT Incident; Network Server; filed 2025-03-06).
• FWMEP Notice of Data Privacy Incident (updated October 2, 2025) — the entity’s substitute notice, hosted on its own site.
• New Hampshire Attorney General — FWMEP Security Breach Notification (October 3, 2025) — state-AG-filed copy of the same notice, with the sample notification letter attached.
• HIPAA Journal — FWMEP Data Breach Affects Almost 30,000 Individuals — detailed trade-press writeup including data elements, threat actor, and notification timeline.
• Comparitech — FWMEP notifies 29,000+ people of data breach — independent confirmation of count and timeline.
• 21Alive News (WPTA Fort Wayne) — Sensitive personal information for 29k+ patients exposed during data breach at Fort Wayne clinic — local reporting establishing the Lutheran Downtown Medical Office Building affiliation.
• ClassAction.org — FWMEP Data Breach Impacts 29K — plaintiff-side litigation tracker.
• Lynch Carpenter LLP investigation announcement (GlobeNewswire, October 6, 2025) — class-action firm announcement.
• Strauss Borrelli PLLC — FWMEP Data Breach Investigation — class-action firm announcement.
• Migliaccio & Rathod LLP — FWMEP Data Breach Investigation — class-action firm announcement.

This page reflects publicly available information as of May 16, 2026; we update it as new filings, court orders, or settlement notices appear in primary records.