BASS Medical Group, a healthcare provider based in Walnut Creek, California, has publicly disclosed a data security incident involving its network environment. According to the notice, the group found suspicious activity, brought in outside cybersecurity specialists, and later concluded that certain personal and protected health information may have been accessed or acquired without authorization.
Healthcare organizations hold some of the most sensitive records that exist, and they carry a responsibility to safeguard that information. When a security failure exposes patient data, the people affected deserve clear answers about what happened and what they can do next.
BASS Medical Group’s Data Breach Investigation
BASS Medical Group published a notice dated October 22, 2026 describing a data security incident affecting its network. The practice, located in Walnut Creek, California, states that it noticed suspicious activity within its network environment on or around September 4, 2026. After that discovery, the group says it moved to secure its systems and opened an investigation with the help of independent cybersecurity experts to determine the source and scope of what took place.
On or about September 22, 2026, that investigation concluded that certain personal and protected health information may have been accessed or acquired without authorization. The wording matters: the group has said the information may have been involved, which is a common way for organizations to describe an incident when forensic work cannot rule out access to a particular data set. The notice also says that not every type of information was involved for every person, so the exposure can differ from one patient to the next.
The notice states that the files at issue may have contained medical treatment codes or billing information, along with health insurance information. BASS reports that it has no evidence so far suggesting that the information has been misused or that anyone attempted to misuse it. The group says it implemented additional safeguards after discovering the incident to strengthen its systems and lower the chance of a repeat event, and that it set up a toll-free call center to field questions from people who want to know more.
BASS also reports that it notified the California Attorney General, the Federal Bureau of Investigation, and the U.S. Department of Health and Human Services Office for Civil Rights. Those reports are typical when a healthcare provider experiences an event involving protected health information. As of this writing, the group has not published a total number of people affected, and it has not publicly explained how the unauthorized access occurred. Details like these are sometimes shared later through regulatory filings or follow-up notices, so this page may be updated as new information becomes available.
Because the available facts are limited, it helps to understand the wider context. Medical practices are frequent targets for cybercriminals because patient records combine identifying details, insurance data, and treatment information in one place. Unlike a credit card number, a medical or insurance record cannot simply be canceled and reissued, which gives the information lasting value to anyone who obtains it.
Billing codes and health insurance details can be used in several ways. A person who obtains insurance information may try to obtain care or prescriptions under another person’s coverage, submit false claims, or build a convincing profile for later scams. Treatment codes can reveal sensitive details about a person’s health history, and that information can be used to craft targeted phishing messages that appear to come from a doctor’s office, an insurer, or a billing department. Patients who receive unexpected calls, texts, or emails about their care should confirm the sender independently before sharing anything.
Notification practices also deserve attention. State and federal rules require healthcare organizations to tell affected people about incidents involving protected health information within set timeframes, and the notice itself should explain what happened, what information was involved, and what steps are being taken. If you were a patient of BASS Medical Group, you may receive a letter by mail. Keep that letter, since it can help document your connection to the incident, and review any explanation of benefits statements you receive from your insurer in the coming months for services you did not receive.
Anyone who believes they were affected may have legal options. Data breach claims often center on whether an organization took reasonable steps to protect the information entrusted to it, and whether it responded promptly once a problem surfaced. Reviewing the facts of this incident with an experienced attorney is the best way to understand whether a claim may be available to you.
When Did This Breach Occur?
BASS Medical Group reports that it discovered suspicious activity within its network environment on or around September 4, 2026. The group then began an investigation with independent cybersecurity experts. On or about September 22, 2026, the investigation determined that certain personal and protected health information may have been accessed or acquired without authorization.
The public notice from the group is dated October 22, 2026. The notice does not state when the unauthorized activity first began, only when it was discovered, so the full period during which data could have been exposed has not been made public.
The gap between discovery, the conclusion of the investigation, and the public announcement is common in healthcare incidents, where forensic review of a data set can take weeks. Affected individuals should watch their mail for a notification letter and not assume that a lack of contact means they were not involved.
What Information Was Breached?
According to the notice, the information that may have been involved includes medical treatment codes or billing information and health insurance information. The group states that not all information was involved for all individuals, so the data exposed may vary by person.
BASS says it currently has no evidence suggesting the information has been misused or that anyone attempted to misuse it. The notice does not list Social Security numbers, financial account numbers, or other identifiers among the data types, and the group has not published a complete breakdown beyond what is described above.
Even without identity numbers, insurance and billing details can carry real risk. They may support medical identity theft, fraudulent claims, or convincing impersonation attempts, so affected patients should stay alert.
What You Can Do
If you received a notice from BASS Medical Group or believe your information may be involved, consider these steps:
- Read your explanation of benefits statements and medical bills carefully, and report any service you did not receive to your insurer right away.
- Review your account statements and credit reports for unfamiliar activity, and report suspected identity theft to law enforcement, your state attorney general, or the Federal Trade Commission.
- Request your free credit reports from Equifax, Experian, and TransUnion through annualcreditreport.com.
- Think about placing a free fraud alert or security freeze on your credit file with each of the three credit bureaus.
- Be cautious with unexpected calls, texts, and emails that mention your care, insurance, or billing, and verify the sender before responding.
- Use the call center number listed in the notice if you have questions for BASS directly.
File a Data Breach Lawsuit Against BASS Medical Group
People affected by a healthcare data breach may be able to pursue a claim against the organization responsible, particularly when sensitive health and insurance information was left exposed. A class action allows many affected individuals to join together, which can make it practical to hold an organization accountable.
If you were notified that your information was involved in the BASS Medical Group incident, it may be worth speaking with a lawyer about your options. Having a clear record of your notice letter, any suspicious activity, and any costs you have faced can help.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
