Highlands Oncology Group Data Breach 2025: 111,766 Cancer Patients Exposed in Medusa Ransomware Attack. What Was Stolen and What To Do

Highlands Oncology Group is a comprehensive cancer-care practice operating six locations across Northwest Arkansas and North Central Arkansas: Rogers (two campuses at South 52nd Street and Pinnacle Hills), Springdale, Fayetteville (North Hills and Fayetteville Radiation), and Mountain Home at Baxter Health. On August 1, 2025, the practice began notifying patients that an unauthorized actor had been inside its network for more than four months. The Medusa ransomware group claimed responsibility on June 19, 2025, posting sample screenshots on its dark-web extortion portal and setting a $700,000 deadline of July 21, 2025. After that deadline passed, Medusa’s listing for Highlands was removed from the extortion site. Security researchers note that listing removal after a deadline is consistent with ransom payment; Highlands has not confirmed or denied whether payment was made.

Two affected-individual counts exist in the public record. The HHS Office for Civil Rights breach portal lists 111,766 affected individuals. The parallel filing with the Maine Attorney General lists 113,575. Multi-state AG filings were also made with the New Hampshire, Massachusetts, Texas, Iowa, Montana, Nebraska, Oregon, Rhode Island, South Carolina, Vermont, Washington, and California Attorney General offices, confirming national scope. The discrepancy between the OCR and Maine AG counts is common in healthcare breach reporting and typically reflects de-duplication rather than a change in scope.

Timeline

• January 21, 2025 — Unauthorized actor first gains access to the Highlands Oncology network, per the forensic investigation cited in the notification letter.
• June 2, 2025 — Highlands detects the intrusion. Files and systems become inaccessible. Containment begins. Law enforcement and a third-party forensic firm are engaged.
• June 19, 2025 — Medusa ransomware group publicly claims the attack on its dark-web extortion portal, posting sample screenshots of stolen data and setting a $700,000 ransom demand with a July 21, 2025 deadline.
• July 21, 2025 — Ransom deadline expires. Medusa’s listing for Highlands is subsequently removed from the extortion site, consistent with ransom payment (unconfirmed by Highlands).
• August 1, 2025 — Highlands files breach reports with the HHS OCR (111,766 individuals), the Maine AG (113,575), the New Hampshire AG, and the Massachusetts AG. Individual notification letters begin mailing the same day. Wyckoff v. Highlands Oncology Group, P.A. (Case No. 5:25-cv-05166) is filed in the Western District of Arkansas.
• August 4, 2025 — Texas AG breach disclosure filed; at least 504 Texas residents confirmed affected.
• August 2025 onward — Plaintiff firms publicly announce class-action investigations.

What was exposed

The notification letter confirms that the data elements potentially accessed or acquired between January 21 and June 2, 2025 include, depending on the individual:

• Full name
• Date of birth
• Social Security number
• Driver’s license or state identification number
• Passport number
• Credit or debit card number
• Financial account number
• Medical treatment information — for an oncology practice, this category encompasses cancer diagnoses, staging, chemotherapy and radiation regimens, surgical history, and other treatment plan detail
• Medical record number
• Patient account number
• Health insurance policy information

Oncology records carry a category of sensitivity that generic healthcare breaches do not. Cancer diagnosis data, treatment-plan documentation, and any genetic or biomarker testing tied to targeted therapy are the kind of records that affect insurability, employment, and family-member risk profiling, and they are not recoverable. A credit-monitoring product cannot un-disclose a Stage III diagnosis.

The notification letter does not specifically itemize genetic-testing results or tumor-genomic data, but oncology medical records routinely contain that information as part of treatment-plan documentation, and the “medical treatment information” category as worded in the notice does not exclude it.

What Highlands is offering

Affected individuals whose Social Security number or driver’s license number was involved are being offered 12 months of complimentary identity-protection services through Experian IdentityWorks Credit 3B, which includes three-bureau credit monitoring, identity restoration support, and up to $1 million in identity-theft insurance.

Enrollment instructions and the activation code are included in each individual’s notification letter. The dedicated call center number for questions is printed on the letter as well.

Highlands has also stated that it has reviewed and strengthened its security posture, including additional safeguards and monitoring. This is the second ransomware incident the practice has reported publicly. A November 2023 ransomware attack on Highlands Oncology was reported to HHS as affecting 55,297 individuals.

Class-action posture

At least one federal class action has been filed and several additional plaintiff firms are publicly investigating claims.

Filed: Wyckoff v. Highlands Oncology Group, P.A., Case No. 5:25-cv-05166, U.S. District Court for the Western District of Arkansas. The complaint is on the Justia docket.

Public investigations announced by: Strauss Borrelli; Markovits, Stock & DeMarco; Pittman Dutton Hellums Bradley & Mann; McShane & Brady; Schubert Jonckheer & Kolbe; The Lyon Firm; Console & Associates; Schall Law Firm; Edelson Lechtzin LLP; Federman & Sherwood; Migliaccio & Rathod LLP; and Srourian Law Firm (SLFLA), among others.

Plaintiffs’ theories typically include negligence, breach of implied contract, breach of fiduciary duty, and violations of state consumer-protection statutes. Recurring factual emphases in the public investigation notices include the 133-day dwell time, the prior 2023 ransomware incident at the same entity, the multi-state scope of AG notifications, and the sensitivity of oncology records. ClassAction.org’s investigation has concluded; the page is preserved for reference and directs potential plaintiffs to independent legal counsel.

What to do

This week:

1. Activate the Experian IdentityWorks Credit 3B coverage using the activation code in your notification letter. The offer is time-limited; enroll within the window stated in your letter.
2. Place a free credit freeze at Equifax, Experian, and TransUnion. With SSN, driver’s license, passport, and financial-account information all in scope, a freeze is the highest-leverage defensive step.
3. Review your insurance Explanation of Benefits statements for any oncology, infusion, imaging, lab, or pharmacy claims you do not recognize. Medical identity theft using exposed insurance data is the underreported risk in oncology-data breaches.

This month:

4. Stop the ongoing flow of your oncology data downstream. HealthConsent files HIPAA restriction requests and Health Information Exchange opt-outs across providers, insurers, HIEs, and prescription networks so the diagnoses and treatment data exposed in this breach are not continuously re-shared and sold by data brokers and ad-tech platforms.
5. Consider whether to join the class. Wyckoff v. Highlands Oncology Group, P.A. is the filed case; multiple firms are accepting affected individuals into their investigations. We are not a law firm and do not give legal advice.
6. Keep the notification letter. It contains your activation code and is the document plaintiff firms and the OCR will reference if you make a claim or complaint.

Sources

• Highlands Oncology: Notice of a Data Incident — the entity’s substitute notice page.
• Highlands Oncology Notification Letter (classaction.org mirror) — the mailed letter, with the verbatim list of data elements.
• HIPAA Journal: Ransomware Attack on Arkansas Oncology Group Affects 113,500 Individuals — confirms OCR count (111,766), Maine AG count (113,575), Medusa ransom ($700,000), and the prior 2023 ransomware incident.
• DataBreaches.Net: Highlands Oncology notifies 113,575 after Medusa attack — Medusa leak-site listing and ransom deadline.
• CyberInsider: Ransomware Attack on Highlands Oncology Exposes Data of Over 113,000 Patients — corroborating coverage of dwell time and data categories.
• Justia Dockets: Wyckoff v. Highlands Oncology Group, P.A. (5:25-cv-05166, W.D. Ark.) — federal class-action docket.
• Strauss Borrelli: Highlands Oncology Group Data Breach Investigation — plaintiff-firm investigation notice.
• Federman & Sherwood: Highlands Oncology Group PA Data Breach Investigation — plaintiff-firm investigation notice (August 4, 2025).
• Migliaccio & Rathod LLP: Highlands Oncology Data Breach Investigation — plaintiff-firm investigation notice (August 5, 2025).
• RedCell Security: Highlands Oncology Group — When Security Fixes Fail — cybersecurity analysis of the second ransomware incident; documents the pattern of insufficient post-incident remediation following the November 2023 breach.
• Edelson Lechtzin LLP: Data Breach Alert — Highlands Oncology Group PA — additional plaintiff-firm investigation announcement (August 4, 2025).
• Maine AG Breach Filing: Highlands Oncology Group PA — official AG filing confirming 113,575 affected individuals, 6 Maine residents, and Experian IdentityWorks 12-month monitoring offer.
• ClaimDepot: Highlands Oncology Data Breach — multi-state AG filing tracker; confirms June 19 Medusa claim date, Texas AG filing (504 residents), and NH and MA AG filings.
• Defensorum: 113,500 Individuals Affected by Highlands Oncology Group Ransomware Attack — confirms Medusa listing removed from leak site after deadline; FBI/CISA Medusa advisory context; DaVita parallel.
• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach.

HealthConsent is independent and is not affiliated with Highlands Oncology Group or any of the firms listed above.