The Orthopaedic Institute of Western Kentucky (OIWK), now part of Mercy Health – Western Kentucky Orthopedics, has reported a data breach involving sensitive patient information. The breach occurred due to a cybersecurity incident at their third-party vendor, Keystone Technologies, in 2025. If you were affected, you may be entitled to compensation through a class action lawsuit.
Orthopaedic Institute of Western Kentucky’s Data Breach Investigation
On January 15, 2026, the Orthopaedic Institute of Western Kentucky (OIWK) confirmed that a data breach occurred due to a cybersecurity incident involving Keystone Technologies, a third-party vendor that provided managed IT services to OIWK. The breach involved two separate incidents, one between April 21 and April 26, 2025, and another between July 19 and August 1, 2025. Unauthorized third parties gained access to certain computer systems hosted by Keystone Technologies and obtained files that contained sensitive patient information.
The breach was discovered during an investigation initiated by OIWK, with the assistance of an external forensic firm. The investigation revealed that the files involved in the breach contained personal and medical information, such as names, Social Security numbers, dates of birth, addresses, medical record numbers, health insurance details, and treatment information. Notably, OIWK’s own electronic medical record system, as well as Mercy Health’s IT and medical record systems, were not affected by the breach.
Although OIWK has not received reports of fraud or identity theft related to the breach, they are offering protection services to affected individuals to help prevent further risks.
When Did This Breach Occur?
The breach occurred in two distinct incidents:
-
April 21, 2025, to April 26, 2025
-
July 19, 2025, to August 1, 2025
These incidents resulted in unauthorized access to certain files containing sensitive patient information. The breach was discovered in late 2025, and OIWK notified affected individuals in early 2026.
What Information Was Breached?
The data breach exposed several critical pieces of personal and medical information, including:
Although the breach did not affect OIWK’s internal systems or Mercy Health’s systems, the exposed data still poses a significant risk to affected individuals. It is important for individuals to take the necessary steps to protect their personal and health information.
What You Can Do
If your information was affected by this breach, there are several steps you can take to protect yourself:
-
Enroll in Identity Protection Services – OIWK is offering a free 12-month membership to Experian® IdentityWorksSM Credit 3B. This service helps detect potential misuse of your personal information and provides identity theft protection services. Enrolling in this service will not impact your credit score.
-
Monitor Your Accounts – Keep a close eye on your medical bills, explanation of benefits forms, and financial accounts for any suspicious charges or activity. If you spot any unusual activity, contact your healthcare provider or insurance company immediately.
-
Place a Fraud Alert or Credit Freeze – You can place a fraud alert on your credit file to prevent new credit from being opened in your name. Alternatively, you may wish to place a credit freeze, which restricts access to your credit report, further protecting your identity.
-
Review Your Medical Records – Check for any fraudulent claims or services listed under your name. Ensure that no unauthorized treatments or charges are being made.
By taking these steps, you can help minimize the potential risks of identity theft and fraud related to the breach.
File a Data Breach Lawsuit Against Orthopaedic Institute of Western Kentucky
If you were notified about this breach or believe your information was compromised, you may be eligible to join a class action lawsuit. A class action lawsuit could allow you to seek compensation for damages resulting from the breach, such as emotional distress, loss of privacy, and the time spent dealing with the consequences of the incident.
Contact us at Class Action U to learn more about your rights and how to join a class action lawsuit. We can connect you with experienced attorneys who specialize in data breach cases and help you navigate the legal process.
Fill out our quick, easy, secure form to get in touch with a lawyer today. There’s no cost to reach out, and no obligation after speaking with one of our legal experts
