Practice Management, an Illinois-based healthcare revenue cycle management company that provides medical billing services to Federally Qualified Health Centers and physician practices nationwide, is being investigated for a possible data breach. The company has not yet publicly confirmed the incident.
Companies that manage sensitive billing and patient-related data on behalf of healthcare providers have a responsibility to keep that information secure, and any confirmed compromise could put both employees and the patients of the company’s healthcare clients at risk.
Practice Management’s Data Breach Investigation
According to a September 17, 2026 post on the dark web monitoring site Ransomware.live, the ransomware group Akira claimed responsibility for a cyberattack on Practice Management, alleging that it obtained approximately 43 gigabytes of corporate data, including employee and client personal information. The claimed attack was estimated to have occurred on or around the same day the post was made. As of this writing, Practice Management has not issued a public statement confirming the scope or nature of the incident, and no state attorney general filing or formal notification letter has yet surfaced publicly.
Attorneys working with ClassAction.org have opened an investigation into the reported incident and are seeking to hear from current and former Practice Management employees, as well as patients of the healthcare providers the company serves, who believe their information may have been exposed.
Ransomware groups like Akira typically follow a double extortion model, in which stolen data is used as leverage to pressure a victim organization into paying a ransom, with the threat of publishing the data publicly if payment is not made. Because Practice Management works with Federally Qualified Health Centers and physician practices across the country, any data actually taken in this incident could extend well beyond the company’s own employees to the patients of the healthcare organizations it serves.
Healthcare-adjacent service providers, including billing and revenue cycle management companies, have become frequent ransomware targets because they often hold large volumes of sensitive financial and personal information while maintaining fewer dedicated cybersecurity resources than the hospitals and health systems they support. A single compromise at a billing vendor can expose records belonging to patients of many unrelated healthcare providers at once, since the vendor’s systems often aggregate data across all of its clients.
Until Practice Management or an official regulatory filing confirms the specific categories of information involved, the exact scope of what may have been exposed remains unclear. Individuals who worked for Practice Management, or who are patients of a healthcare provider that uses its billing services, should stay alert for any official notification and monitor their accounts for suspicious activity in the meantime.
When Did This Breach Occur?
The ransomware group Akira claimed responsibility for the attack in a post dated September 17, 2026, with the incident estimated to have occurred on or around that same date. Practice Management has not publicly confirmed a breach or disclosed a specific incident timeline.
What Information Was Breached?
Akira’s claim references approximately 43 gigabytes of corporate data, described as including employee personal information and client personal information. Specific categories of data, such as Social Security numbers or medical information, have not been publicly disclosed by Practice Management or confirmed through an official filing at this time.
What You Can Do
If you are a current or former Practice Management employee, or a patient of a healthcare provider that uses its billing services, consider taking the following steps:
- Watch for any official notification letter from Practice Management or a healthcare provider that uses its services
- Monitor your financial accounts and, if applicable, your health insurance statements for unfamiliar activity
- Consider placing a fraud alert or credit freeze with the three major credit bureaus (Equifax, Experian, and TransUnion) as a precaution
- Be cautious of unsolicited calls, texts, or emails referencing this incident, and never share personal information with an unverified contact
File a Data Breach Lawsuit Against Practice Management
If you believe your information was exposed in connection with this incident, you may have legal options. Companies that manage sensitive billing and patient-related data are expected to maintain reasonable security measures, and a confirmed failure to do so can expose current and former employees, as well as the patients of the healthcare providers a company serves, to a real risk of identity theft and fraud.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
