How do I know if I am affected by the Southern Immediate Care, LLC data breach?

Southern Immediate Care, LLC is mailing notification letters directly to affected individuals. If you have received care or services from Southern Immediate Care, LLC in the period leading up to January 2026 and you have not received a letter, contact the entity directly. 7,447 individuals were confirmed affected in the HHS OCR filing.

What data was exposed in the Southern Immediate Care, LLC breach?

According to the notification letter and supporting filings, the compromised data included: Full name, Home address, Date of birth, Social Security number, Government IDs, Medical / treatment information, Health insurance details, Financial / payment information.

Was Southern Immediate Care, LLC attacked by a ransomware group?

No threat actor has publicly claimed responsibility for the Southern Immediate Care, LLC breach. The incident is categorized in the HHS OCR portal as a phishing.

What is HealthConsent and how does it help with the Southern Immediate Care, LLC breach?

HealthConsent is an independent health-data privacy service. We help affected individuals stop the ongoing flow of their health information by filing HIPAA restriction requests, FTC Health Breach Notification Rule deletion requests, and state-law deletion requests across providers, insurers, Health Information Exchanges, prescription networks, and data brokers. Credit monitoring offered by Southern Immediate Care, LLC addresses identity-theft risk; HealthConsent addresses the longer-tail problem of your exposed health data continuing to be sold and shared by other entities downstream.

Active breach tracker Alabama Disclosed January 15, 2026

Southern Immediate Care Data Breach 2026: 7,447 Alabama Urgent-Care Patients Exposed via Email Compromise. What To Do

Q: Should I file a lawsuit over the Southern Immediate Care, LLC data breach?

4 plaintiffs' firms have publicly announced investigations or filed complaints related to the Southern Immediate Care, LLC breach: Federman & Sherwood (publicly investigating), Strauss Borrelli (publicly investigating), Pittman Dutton (publicly investigating), The Lyon Firm (publicly investigating). We are not a law firm and cannot give legal advice; consult your own attorney to evaluate your options.

Southern Immediate Care, an Alabama urgent-care chain with nine walk-in clinics, disclosed in January 2026 an April 2025 employee email compromise exposing names, Social Security numbers, dates of birth, government IDs, medical information, and financial information for 7,447 patients. Free credit monitoring offered. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated May 15, 2026 Sources & methodology

Timeline

Apr 1, 2025

Unauthorized access to employee email account begins

Apr 15, 2025

Investigation confirms two employee mailboxes accessed; data potentially downloaded

Aug 1, 2025

Initial public Notice of Data Event posted; law-firm investigations open

Jan 15, 2026

Filed with HHS OCR

Apr 1, 2025

Unauthorized access to employee email account begins

Apr 15, 2025

Investigation confirms two employee mailboxes accessed; data potentially downloaded

Aug 1, 2025

Initial public Notice of Data Event posted; law-firm investigations open

Jan 15, 2026

Filed with HHS OCR

Data exposed

High-risk identity

Enables financial + identity theft

Date of birth Social Security number Government IDs

Health records

Don't expire and can't be reissued

Medical / treatment information

Contact & insurance

Phishing + targeted scams

Full name Home address Health insurance details Financial / payment information

Class actions filed by

These firms have publicly announced investigations. You may be eligible to join. We are not a law firm and cannot give legal advice.

Federman & Sherwood (publicly investigating) Strauss Borrelli (publicly investigating) Pittman Dutton (publicly investigating) The Lyon Firm (publicly investigating)

If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

Accept credit monitoring

It’s the floor of the response. Take it.

Freeze your credit

Free at Equifax, Experian, TransUnion.

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

Review your EOBs

Insurance statements catch medical identity theft early.

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

Southern Immediate Care, LLC is an Alabama urgent-care chain operating nine walk-in clinics across central and northeast Alabama: Anniston, Attalla, Forestdale, Heflin, Helena, Homewood, Stringfellow, Lakeshore, and Valleydale. Services include non-emergency illness/injury care, primary care, and occupational medicine.

In early April 2025, an unauthorized actor accessed two employee email accounts. The investigation confirmed the unauthorized access on April 15, 2025, including potential download of data from the mailboxes. The initial public Notice of Data Event was posted in August 2025; law-firm investigations followed.

Southern Immediate Care filed with HHS OCR on January 15, 2026 — classified as Hacking/IT Incident at Email — confirming 7,447 affected individuals.

The breach vector is business email compromise / credential phishing. No ransomware group has claimed responsibility.

What was stolen

Per aggregator and notification-letter reporting:

Full name, home address, date of birth
Social Security number
Government IDs
Medical / treatment information
Health insurance details
Financial / payment information

What Southern Immediate Care is offering

Free credit monitoring is referenced in the notification letters (vendor and duration not enumerated in public sources).

Dedicated call center: (205) 749-2048 (Monday to Friday, 8 a.m. to 6 p.m. Central)

What to do

Enroll in the offered monitoring through the activation code in your letter.
Place free credit freezes at Equifax, Experian, TransUnion.
File IRS Form 14039.
Cancel and reissue any payment cards that may be tied to financial / payment information.
Stop the ongoing flow of your urgent-care data. HealthConsent files HIPAA restriction requests so the demographic and treatment-context data exposed in this breach is not continuously re-shared.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.