Comprehensive Orthopaedics, a Connecticut orthopedic practice, has notified patients of a data security incident in which an unauthorized party accessed files on its network containing personal, financial and protected health information.
Comprehensive Orthopaedics’s Data Breach Investigation
Comprehensive Orthopaedics, formally Comprehensive Orthopedics & Musculoskeletal Care, LLC, is a privately owned orthopedic practice with four locations in Connecticut. In a Notice of Data Security Incident dated August 14, 2026, the practice explained that it became aware of suspicious activity on its network on February 12, 2026. It says it moved immediately to secure its environment and hired an outside forensic firm to investigate.
That investigation determined that certain files on the network had been accessed by an unauthorized third party. The practice then carried out a review of those files to work out whether they held personal information or protected health information, what that information was, and whom it related to. According to the notice, the investigation and file review were completed on June 17, 2026, and found that the affected files may have contained protected health information.
Public breach trackers, drawing on the practice’s report to the U.S. Department of Health and Human Services, put the number of people affected at 21,897. The practice’s own notice does not state a total. That figure comes from the federal breach report rather than from the notice text, so readers should treat it as the number reported to regulators.
The timeline shows a gap of more than four months between the day the practice first noticed suspicious activity and the day the file review finished, and a further gap before notice letters were mailed. Reviews of this kind are slow because every file has to be examined, individuals have to be matched to what was found, and current addresses have to be located. For patients, that means sensitive information may have been exposed for a long time before anyone told them.
Orthopedic practices collect a wide range of records. Patients routinely provide identification, insurance details and payment information when they schedule surgery, physical therapy or imaging, and the clinical records that follow can describe injuries, procedures and treatment history. When files containing that combination are accessed, the exposure can reach well beyond a name and address, because each category of data can be used for a different kind of fraud.
According to the notice, the practice secured its network, reset passwords, secured all accounts and carried out a full investigation. It is mailing notification letters to potentially affected individuals and has set up a dedicated assistance line at 203-265-3280, staffed Monday through Friday from 9 a.m. to 5 p.m. Eastern Time, excluding holidays, for anyone with questions about the incident or the letter they received.
The notice does not say that any individual’s information has been misused, and it does not describe credit monitoring being offered. It instead encourages people to stay alert by reviewing credit reports, account statements and explanation of benefits forms for suspicious activity. Because Social Security numbers and dates of birth do not change, that vigilance is worth keeping up for years after a breach, not just in the first few weeks.
Healthcare providers of every size are frequent targets because patient files combine identity, insurance and payment details in one place, and that combination can be worth more to criminals than a typical consumer account. Smaller and mid-sized practices often run lean IT environments, which can make it harder to spot unusual activity quickly. State and federal notification rules exist so that people learn about an exposure and can take protective steps, and a breach report to the federal government is generally triggered when the health information of 500 or more people is involved. Those reports are public, which is how the scale of this incident became known outside the practice. Patients who are unsure whether their records were among those reviewed can use the assistance line to ask.
When Did This Breach Occur?
Comprehensive Orthopaedics became aware of suspicious activity on its network on February 12, 2026. The investigation and file review concluded on June 17, 2026, and the practice published its notice on August 14, 2026.
What Information Was Breached?
The information involved may include an individual’s first and last name in combination with one or more of the following: date of birth, Social Security number, government-issued identification, financial account information and/or payment card information, medical information, and health insurance information. Which items were involved differs from person to person, and the notification letter you received is the best guide to what applies to you.
What You Can Do
If you received a notification letter from Comprehensive Orthopaedics, consider these steps to protect yourself:
- Review your credit reports at annualcreditreport.com, which offers one free report a year from each of the three major bureaus.
- Place a fraud alert or a free credit freeze with Equifax, Experian and TransUnion.
- Check your health insurance explanation of benefits and bank or card statements for charges or services you do not recognize.
- Watch for phishing calls, texts and emails that mention your care or your insurance.
- Report suspected identity theft to the Federal Trade Commission at identitytheft.gov and to your state Attorney General.
File a Data Breach Lawsuit Against Comprehensive Orthopaedics
If you received a notice that your personal, financial or health information was involved in the Comprehensive Orthopaedics data breach, you may be entitled to compensation. Medical practices that collect Social Security numbers, payment details and treatment records are expected to take reasonable steps to protect them, and people affected by a breach can face a lasting risk of identity theft and medical identity fraud.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
