Metro Tulsa Foot & Ankle Specialists has reported a data security incident that involved Social Security numbers, financial account and card information, and health records. This page summarizes what is publicly known from the breach notice summary posted by the Vermont Attorney General.
Metro Tulsa Foot & Ankle Specialists’s Data Breach Investigation
On October 28, 2026, a data security incident reported by Metro Tulsa Foot & Ankle Specialist appeared on the Vermont Attorney General’s list of security breach notices. The listing classifies the reporting organization under the health care category and shows that 6 Vermont residents were affected. The categories of information it lists are Social Security numbers, financial account codes, credit and debit account information, and health records. The practice’s own website uses the name Metro Tulsa Foot & Ankle Specialists and describes a podiatry practice with clinics in the Tulsa, Oklahoma area.
The Vermont listing is the only public record of the incident that has been located so far. Vermont no longer posts copies of the notice letters that organizations send, so the summary does not describe how the incident happened, how it was discovered, or what the practice is doing in response. No notice letter, press statement or regulator filing with further detail has been found.
The figure of 6 covers only Vermont residents. The total number of people affected, including residents of other states, has not been published, and organizations that notify people in several states often file separate reports with different counts. The Vermont figure should not be read as the total.
The cause has not been disclosed. Nothing in the public listing indicates whether an outside attacker, a vendor, a lost device or an internal error was responsible, and it does not say whether credit monitoring or identity protection is being offered to people who were notified. Anyone who received a letter should rely on it for those details.
The combination of information listed is serious. Social Security numbers are the key identifier used to open credit accounts, file tax returns and apply for benefits, and they cannot easily be replaced. Financial account codes and card details can support unauthorized charges or account takeover. Health records can reveal diagnoses, treatments, medications and insurance details, and they can be used for medical identity theft, fraudulent billing and scams that cite real details about a person’s care. When all of these appear together in one incident, a single exposed record can support several different kinds of fraud.
Medical practices are frequent targets because their files combine identity, payment and clinical information in one place. Podiatry and other specialty practices often keep records for many years, including insurance details and billing history, so older patients and former patients can be affected as well as current ones. This is general industry context and not a finding about this particular incident.
State and federal laws generally require health care providers to protect patient information and to notify affected people without unreasonable delay. Whether a practice used reasonable safeguards, and whether its notice met the standards that apply, are the kinds of questions that data breach claims often examine.
When Did This Breach Occur?
The public Vermont listing gives the date the incident was reported, October 28, 2026, but not the date it happened or the date it was discovered. No timeline showing when unauthorized access began, when it was detected or when it ended has been published, so the timing of the underlying event should be treated as unknown for now. A notice letter, if you receive one, should give those dates.
What Information Was Breached?
The Vermont listing states that the information involved included Social Security numbers, financial account codes, credit and debit account information, and health records. A fuller breakdown has not been published, and the listing does not say which data types applied to which people. Your notice letter is the best guide to what was involved in your case.
What You Can Do
If you received a notice related to Metro Tulsa Foot & Ankle Specialists or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Because health records were listed, review insurance statements and explanations of benefits for services you did not receive, and consider asking your health insurer to flag your account for suspicious activity.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Metro Tulsa Foot & Ankle Specialists
If you received a notice about this incident, or you believe your health or financial information was involved, you may have legal options for holding the practice accountable for how it protected your sensitive information.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
