Heart South Cardiovascular Data Breach 2026 (Rhysida Ransomware): 46,666 Alabama Cardiology Patients Exposed. Second Breach in 18 Months. What To Do

What happened

Heart South Cardiovascular Group, P.C. is a central Alabama cardiology and vascular practice with three locations in Alabaster, Clanton, and Centreville, staffed by 11 board-certified cardiologists and 10 advanced-practice providers.

On approximately November 10, 2025, the Rhysida ransomware group attacked Heart South’s network. On November 11, Rhysida claimed responsibility on its dark-web leak site, posting sample documents that included ID scans and medical records and demanding approximately 6 BTC (~$630,000) in ransom.

The forensic review identifying affected individuals was completed on February 12, 2026. Heart South filed with the HHS Office for Civil Rights and the Maine Attorney General on April 6, 2026, and began mailing individual notification letters. The filings confirmed 46,666 affected individuals (3 Maine residents specifically disclosed).

This is Heart South’s second breach in 18 months. The prior May 2024 incident affected 20,577 individuals and settled for $500,000 in Kornegay v. Heart South (Bibb County Circuit Court). That settlement site is heartsouthsettlement.com.

Notably, Heart South’s public statement claims its investigation “did not find evidence of unauthorized network access or data theft” — a position that directly contradicts both the OCR filing (which categorizes the event as Hacking/IT Incident at Network Server affecting 46,666 individuals) and Rhysida’s posted leak samples. This contradiction is the most significant feature of the disclosure and is likely to be a central issue in any class action.

What was stolen

Per plaintiff-firm summaries of the notification letter and the Rhysida sample documents:

• Full name
• Date of birth
• Social Security number
• Treatments and procedures
• Diagnoses
• Medications
• Health insurance information
• Government ID scans (driver’s license scans visible in Rhysida sample)

What Heart South is offering

• 12 months of complimentary credit monitoring and identity theft restoration (per Maine AG filing)
• Vendor reported as Kroll per Comparitech (not explicitly named in the Maine AG notice extract)

What to do

1. Enroll in the offered credit monitoring through the code in your letter.
2. Place free credit freezes at Equifax, Experian, and TransUnion.
3. File IRS Form 14039 to prevent fraudulent tax filings.
4. Be alert to highly targeted phishing. With your cardiology-specific treatment context known to scammers, “your follow-up appointment” or “your medication refill” scam outreach is realistic.
5. Stop the ongoing flow of your cardiology data. HealthConsent files HIPAA restriction requests so the cardiology treatment data exposed in this breach is not continuously re-shared by downstream entities. Because Rhysida published sample data, your record is in the wild.
6. If you were also affected by the prior 2024 breach, you may have separate claims under both incidents. Consult an attorney.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches