Atlantic Digestive Specialists, a gastroenterology practice based in Somersworth, New Hampshire, announced on September 30, 2026 that a data security incident may have exposed patients’ Social Security numbers, medical information, and other sensitive details.
Atlantic Digestive Specialists’s Data Breach Investigation
Atlantic Digestive Specialists is a gastroenterology practice headquartered in Somersworth, New Hampshire, with offices serving patients in the Seacoast region of New Hampshire and southern Maine. On September 30, 2026, the practice issued a public notice through a national newswire announcing a data security incident that may have involved protected health information. The practice stated that it had already begun mailing notices to potentially affected individuals.
According to that announcement, the practice was alerted to suspicious activity in its network in March 2026 and moved to secure its systems and begin an investigation with the help of outside cybersecurity experts. The investigation determined that some information may have been viewed or acquired without authorization during a two-day window, March 16 through March 17, 2026.
The practice then carried out a detailed review of the files that could have been affected. That review wrapped up in August 2026 and confirmed that personal or protected health information was present in the data at issue. The practice next had to locate current contact details for the people involved, a step it said was completed on September 8, 2026, when it arranged for notices to go out. Mailing of the notices began on September 30, 2026, about six months after the intrusion window.
The scope of the information involved is unusually wide. In addition to basic identifiers, the practice listed government identification numbers, financial and payment card details, and an extensive set of clinical and insurance data. Because the list reaches beyond a name and a single identifier, patients may face several different kinds of risk at once, including identity theft, financial fraud, medical identity theft, and targeted phishing that references real treatment details.
The number of people affected has not been published in the practice’s announcement, and this page does not state one. Patients who have not yet received a letter but believe they may be affected can contact the toll-free call center the practice has established, which is staffed Monday through Friday from 9:00 a.m. to 9:00 p.m. Eastern Time, excluding U.S. holidays, at 1-866-200-0962.
Healthcare practices are an attractive target for this type of incident because patient files combine identity data with insurance and payment details in one place. Federal health privacy rules require covered entities to notify affected people after a breach of unsecured protected health information, and they must also report larger breaches to federal regulators. Notices of this kind commonly appear on the HHS breach portal and with state attorneys general in the weeks that follow, and those filings often include the official count of affected individuals.
The six-month gap between the March 2026 intrusion window and the September 2026 notices is not unusual for incidents involving a large volume of medical records, where each file must be reviewed to determine whose information was in it. Still, patients who were treated by the practice over the years should take the notice seriously and act on it promptly, because the information involved can be misused long after it is first exposed.
This is not the first time the practice has appeared in public breach reporting. News coverage from 2017 describes an earlier, separate data incident at Atlantic Digestive Specialists. That earlier event involved different circumstances and is not part of the 2026 incident described here, but patients who have been with the practice for many years may have received more than one notice over time and should keep each one for their records.
Because the announcement lists such a broad range of data types, it is worth treating any notice from the practice as a priority piece of mail. Keep the envelope and letter, note the date you received it, and record any calls or emails you make in response. If the practice offers credit monitoring or identity protection, the enrollment instructions and deadline will appear in the notice itself.
When Did This Breach Occur?
Atlantic Digestive Specialists reported that its network was alerted to suspicious activity in March 2026, and that its investigation determined information may have been viewed or acquired without authorization between March 16, 2026 and March 17, 2026. The file review concluded in August 2026, contact information for affected individuals was located by September 8, 2026, and notice to individuals began on September 30, 2026.
What Information Was Breached?
The practice reported that the information involved may include first and last name, Social Security number, driver’s license or state identification number, date of birth, financial account information, payment card information, alien registration number, taxpayer identification number, and passport number. It may also include clinical information, diagnosis, medical history, medical record number, treatment or procedure information, mental or physical condition, prescription information, Medicaid or Medicare number, medical cost, dates of service, medical provider name, patient account number, health insurance policy number, username and password information, and digital or electronic signature. Not every item applies to every person.
What You Can Do
If you are a patient of Atlantic Digestive Specialists or received a notice, consider these steps:
- Read the notice carefully to see which of your details were involved.
- Place a fraud alert or credit freeze with Equifax, Experian, and TransUnion.
- Review insurance statements and explanation of benefits forms for services you did not receive.
- Change any passwords tied to patient portals and anywhere else you reused them.
- Request a free credit report at annualcreditreport.com and look for unfamiliar accounts.
- Report suspected identity theft to the Federal Trade Commission and your state Attorney General.
File a Data Breach Lawsuit Against Atlantic Digestive Specialists
If you received a notice that your information was exposed in the Atlantic Digestive Specialists data breach, you may be entitled to compensation. Healthcare providers are expected to take reasonable steps to protect patient information, and when a breach occurs, affected patients can face a lasting risk of identity theft, medical fraud, and targeted phishing.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
