Sharp Community Medical Group Data Breach 2025: 26,976 Affected via Episource Ransomware. What Was Stolen and What To Do

Sharp Community Medical Group, a San Diego independent physician association affiliated with Sharp HealthCare, filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on June 6, 2025, reporting 26,976 affected individuals in a Hacking/IT Incident classified as a Network Server event. The underlying root cause was not an intrusion of Sharp Community Medical Group’s own systems; SCMG was a downstream victim of the Episource ransomware attack, in which a criminal actor maintained unauthorized access to the network of Episource (a HIPAA business associate owned by Optum / UnitedHealth Group) between January 27 and February 6, 2025, and copied data out of Episource’s systems during that ten-day window.

Timeline

• January 27, 2025 — Unauthorized access to Episource’s network begins. SCMG patient data resident on Episource systems is in scope from this date forward.
• February 6, 2025 — Episource detects unusual activity and contains the intrusion.
• April 23, 2025 — Episource notifies its covered-entity clients, including Sharp HealthCare and Sharp Community Medical Group, that SCMG patient information was involved.
• June 6, 2025 — Sharp Community Medical Group files its own HIPAA breach notification with HHS OCR (26,976 individuals) and with the California Attorney General. Individual notification letters begin going out to affected patients.

What was exposed

Per the Sharp HealthCare substitute notice and the Episource notification letter template filed with the California Attorney General, the data potentially copied for Sharp Community Medical Group patients includes:

• Full name, mailing address, phone number, email address
• Date of birth
• Health insurance information, including plan name, member ID, group ID, and payer ID
• Medical record numbers and treating provider names
• Clinical content: diagnoses, prescribed medications, test results, and treatment information

The Sharp-specific notification states that Social Security numbers, driver’s license numbers, financial account numbers, and payment card information were not included in the data pulled for SCMG patients. Plaintiffs’ firms investigating the broader Episource breach have referenced SSN exposure in the underlying dataset; this reflects that Episource’s full breach population (6.7M people across many covered entities) is broader than the SCMG-specific cohort. Read your individual notification letter for the exact list of data elements pulled for your record.

What Sharp Community Medical Group is offering

Through Episource, affected individuals are being offered 24 months of complimentary credit monitoring and identity-theft protection via IDX (now part of ZeroFox). The enrollment code is contained in each individual notification letter.

• IDX call center: (877) 786-0549, weekdays
• Initial enrollment deadline cited in early letters: September 30, 2025. If your letter arrived later, the deadline on your specific letter applies.

Class actions and regulatory posture

The Sharp Community Medical Group filing flows into the broader In re Episource LLC Data Breach Litigation consolidated in the Central District of California (lead case Finke v. Episource, LLC, 2:25-cv-05330). Multiple plaintiffs’ firms have publicly opened investigations into SCMG patient claims, including Federman & Sherwood, Strauss Borrelli PLLC, Siri & Glimstad LLP, and the Srourian Law Firm. These investigations evaluate potential claims against both Episource (as the breached business associate) and Sharp Community Medical Group (as the covered entity responsible for safeguarding patient data and timely notification under HIPAA and the California Confidentiality of Medical Information Act).

The HHS OCR entry remains open as of this writing, with no public enforcement resolution. The California Attorney General filing was made on June 6, 2025.

What to do if you received a notification letter

This week:

1. Enroll in the IDX credit monitoring using the code in your letter. Twenty-four months is the longer end of what is typically offered; use the full window.
2. Place a free credit freeze at Equifax, Experian, and TransUnion. This is the single highest-leverage step against new-account identity fraud and is independent of whether you enroll in IDX.
3. Review recent Explanation of Benefits statements from your health plan for services you did not receive. Medical identity theft surfaces in EOBs weeks or months after the fraud.
4. Watch for a second letter. If you are also a Sharp HealthCare patient (not just SCMG), or a member of an Anthem, Wellcare, or other Episource-served plan, you may receive a separate notification covering a different data slice.

This month:

5. Stop the ongoing flow of your health data. HealthConsent files HIPAA restriction requests and Health Information Exchange opt-outs across providers, insurers, HIEs, and prescription networks so the demographic and insurance information exposed in this breach is not continuously re-shared and resold by other entities downstream.

Sources on this page

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach.
• Sharp HealthCare: Episource Data Breach Notice — Sharp’s public substitute notice on the underlying Episource incident.
• HIPAA Journal: Episource Cyberattack Affects More Than 5.4 Million Individuals — established trade press coverage confirming the SCMG filing.
• Federman & Sherwood: SCMG and Episource Investigation — class-action plaintiffs’ firm investigation page covering the SCMG cohort.
• Strauss Borrelli PLLC: Sharp HealthCare Data Breach Investigation — class-action plaintiffs’ firm investigation page.
• Srourian Law Firm: Sharp Community Medical Group Investigation — class-action plaintiffs’ firm investigation page.
• TechTarget: Episource data breach affects 5.4M individuals — secondary trade press coverage of the underlying business-associate breach.