Woundtech (Wound Technology Network) Data Breach 2026 (FulcrumSec): 139,830 Patients Exposed. 93,000 Wound Photos in Stolen Data. No Credit Monitoring Offered. What To Do

What happened

Wound Technology Network, Inc. (Woundtech) is a mobile advanced-wound-care provider founded in 1999. It treats chronic and complex wounds (diabetic ulcers, pressure injuries, surgical wounds) in patients’ homes, skilled nursing facilities, assisted-living facilities, and group homes rather than in a hospital setting. Headquartered in Orlando, Florida, with a portfolio of partnerships with health plans and medical groups. Owned by Aldrich Capital Partners.

On December 6, 2025, Woundtech detected unusual activity inside its network. The access window was contained between December 6 and December 9, 2025. The company engaged a third-party cybersecurity firm and, on December 31, 2025, the forensic investigation confirmed that the attacker had exfiltrated patient data.

Woundtech filed with the US Department of Health and Human Services Office for Civil Rights on January 28, 2026 (139,830 individuals), within HIPAA’s 60-day reporting window. The forensic review of which patients were affected was still ongoing at that point.

On February 1, 2026, the data-theft extortion group FulcrumSec publicly claimed the attack on a leak channel, asserting that it had stolen approximately 3.8 terabytes of data including roughly 4.6 million clinical notes, 85,000 referral documents, and 93,000 wound photographs. FulcrumSec stated the attack vector was an internet-facing server with plaintext AWS and database credentials. The group threatened to publish the full dataset unless contacted.

After completing the affected-individual review, Woundtech posted its public notice on March 16, 2026, filed with the California, Texas, and Vermont Attorneys General, and began mailing individual notification letters. On March 21, 2026, the first federal class action was filed (Cordes v. Wound Technology Network, 6:26-cv-00625, M.D. Fla., Orlando Division).

What was stolen

The notification letter confirms the compromised data included:

• Full name
• Date of birth
• Phone number
• Gender
• Clinical notes
• Medical health, treatment, and diagnosis information
• Health insurance information
• Medical treatment images (wound photographs)
• Social Security number (for a very limited subset)

The medical-treatment images are unusual and worth flagging. Wound photography is part of routine wound-care documentation, but seeing identifiable patient body parts in clinical photography appear in a breach dataset is rare. FulcrumSec’s claim that 93,000 wound photographs were in the stolen data, combined with the threat to publish, raises specific privacy harms beyond what most breaches present.

What Woundtech is offering

No complimentary credit monitoring or identity-theft protection is offered in the public notice. Woundtech’s notice directs affected individuals to free fraud-alert and credit-freeze procedures at Equifax, Experian, and TransUnion, plus the FTC at identitytheft.gov. This is uncommon for a breach of this size and a notable departure from healthcare-breach norms.

• Woundtech response line: 833-297-3496 (Monday to Friday, 8 a.m. to 8 p.m. Eastern)

What to do if you received a notification letter

This week:

1. Place free credit freezes at Equifax, Experian, and TransUnion. With limited but non-zero SSN exposure, this is a baseline precaution.
2. Be especially alert to phishing. The exposed dataset includes phone numbers + clinical context (your specific wound condition, treatment dates). Scammers can craft very specific “Woundtech follow-up” or “your wound-care prescription is delayed” outreach.
3. Review your insurance Explanation of Benefits for unfamiliar wound-care or home-health claims.

This month:

4. Stop the ongoing flow of your wound-care and clinical data. HealthConsent files HIPAA restriction requests, FTC HBNR deletion requests, and state-law deletion requests so the clinical and demographic data exposed in this breach is not continuously re-shared by data brokers and downstream entities.
5. Document any out-of-pocket losses if the breach leads to scam losses or fraudulent activity. The federal class action in M.D. Fla. is already filed; recipients with documented losses may have stronger claims.

Frequently asked questions

Were my wound photos really stolen?

FulcrumSec claims approximately 93,000 wound photographs were in the stolen data. Woundtech’s notice confirms “medical treatment images” as a compromised category but does not give a count or specify whether the FulcrumSec claim is accurate. Wound photography is part of standard advanced-wound-care documentation, so the claim is plausible.

Has the data been published?

FulcrumSec threatened to publish the full dataset and posted sample data on a leak channel. Full publication of the 3.8 TB dataset has not been confirmed in public reporting as of mid-May 2026. The threat actor’s pattern suggests partial publication is likely unless Woundtech reached a payment agreement, which has not been disclosed.

Should I sue?

A federal class action is already filed in the Middle District of Florida (Cordes v. Wound Technology Network, 6:26-cv-00625). Plaintiffs’ counsel was not retrievable from public dockets as of mid-May 2026, but the case is active. Two other firms (Bryson Harris Suciu & DeMay, Shamis & Gentile) are publicly investigating. We are not a law firm and cannot give legal advice.

Is HealthConsent affiliated with Woundtech?

No. HealthConsent is an independent health-data privacy service.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches