Associated Endocrinologists, an endocrinology practice serving patients in Michigan, has reported a data security incident involving unauthorized access to its network. The incident has been linked to a claim of responsibility by the ransomware group RansomHouse, and federal breach-reporting records list thousands of affected individuals.
Healthcare providers that maintain patient records are expected to take reasonable steps to secure that information against unauthorized network access, including guarding against ransomware attacks that target medical practices for the sensitive data they hold.
Associated Endocrinologists’s Data Breach Investigation
According to a filing with the U.S. Department of Health and Human Services Office for Civil Rights, Associated Endocrinologists reported a hacking/IT incident involving a network server that affected approximately 4,979 individuals. The filing was submitted on July 29, 2026, and lists Michigan as the location of the affected practice.
Separately, the ransomware group RansomHouse publicly claimed responsibility for a cyberattack against Associated Endocrinologists on February 6, 2026, stating that it would release sensitive patient data unless the practice contacted the group to negotiate. Cybersecurity researchers tracking ransomware activity identified endocrinemds.com, the practice’s website domain, as the target of this claim. It has not been publicly confirmed whether the July federal filing and the February ransomware claim describe the same underlying incident, though the timing and hacking/IT-incident classification are consistent with a ransomware-style network intrusion.
Associated Endocrinologists has not publicly released a copy of a notification letter describing the incident in detail, and publicly available sources do not specify exactly which categories of patient information were accessed or the date on which the practice discovered the intrusion internally. This summary is based on the available federal filing and third-party cybersecurity reporting rather than a complete public notice letter.
Ransomware attacks against healthcare providers have become increasingly common because medical practices store a concentrated mix of identity information, insurance details, and treatment records that can be valuable to cybercriminals on the dark web or useful for extortion. When attackers gain access to a network server, they can potentially view, copy, or encrypt files containing sensitive patient data, and a ransom demand is often paired with a threat to publish stolen files if the victim organization does not pay. Even when a specific list of compromised data types has not been made public, individuals whose information was stored on an affected server may still face real risks from a network intrusion of this kind, including identity theft and medical identity theft.
When Did This Breach Occur?
The ransomware group RansomHouse claimed responsibility for the attack on February 6, 2026. Associated Endocrinologists’ filing with the U.S. Department of Health and Human Services was submitted on July 29, 2026, but that date reflects when the incident was reported to federal regulators, not necessarily when the intrusion itself occurred or was discovered. Associated Endocrinologists has not publicly disclosed the specific date it discovered the incident internally or when notification letters, if any, were mailed to affected individuals.
What Information Was Breached?
Associated Endocrinologists has not publicly disclosed a specific list of the data types involved in this incident. The federal filing categorizes the breach as a hacking/IT incident affecting a network server, which can include any patient information stored on that server, potentially including names, contact information, and health or insurance records. Individuals who receive a notice letter from Associated Endocrinologists should review it carefully for details specific to their own information.
What You Can Do
If you believe you may have been affected by this incident, consider taking the following steps:
- Watch for an official notice letter from Associated Endocrinologists and keep a copy if you receive one.
- Review medical bills, insurance statements, and account activity for services or charges you don’t recognize.
- Monitor your credit reports and consider placing a fraud alert or credit freeze if your personal information may have been involved.
- Be cautious of follow-up phishing attempts, such as scam calls, texts, or emails referencing this incident.
- Document any suspicious activity or signs of identity misuse and report them promptly.
File a Data Breach Lawsuit Against Associated Endocrinologists
If you received a data breach notice from Associated Endocrinologists, or believe your personal or health information was exposed in this incident, you may have legal options. Healthcare organizations that handle sensitive medical and identity information have a responsibility to protect it, and affected individuals may be entitled to compensation.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
