EZaccessMD, LLC, a Rochester, New York company that connects members with health care providers, has disclosed a data breach involving unauthorized access to files on its network. The company says information including Social Security numbers and medical details may be involved, and that its review is still ongoing.
Organizations that collect and store sensitive health and personal information have a responsibility to protect it, and when that protection fails, the people whose records were exposed deserve clear answers about what happened and what comes next.
EZaccessMD’s Data Breach Investigation
EZaccessMD, LLC, which does business as EZaccessMD and operates from Rochester, New York, has posted a notice describing a data security incident on its own website. According to that notice, the company discovered suspicious activity within its environment on or around July 30, 2026. It says it immediately launched an investigation with the help of third-party specialists to learn the full nature and scope of what happened.
That investigation determined that there was unauthorized access to the company’s environment between June 30, 2026 and July 30, 2026, and that certain files and folders on the network were accessed without authorization during that window. In plain terms, an outside party appears to have had access to EZaccessMD’s systems for roughly a month before the activity was noticed. The company has not publicly said how the intruder got in, who was responsible, or whether any files were copied out of the network, and this page does not guess at those details.
The company also states that it is still performing what it describes as a comprehensive and time-consuming review of the affected files. The purpose of that review is to work out what kinds of information were involved and which individuals the information relates to. Once the review is complete, the company says notice will be provided to affected individuals. That means many people whose information sits in those files may not yet have received a letter, even though the incident has already been disclosed publicly.
The incident also appears on the breach portal maintained by the U.S. Department of Health and Human Services Office for Civil Rights. The listing for EZaccessMD, LLC shows the state as New York, the entity type as a business associate, the number of individuals affected as 501, the submission date as September 25, 2026, the type of breach as a hacking or IT incident, and the location of the breached information as a network server. A business associate is an organization that handles health information on behalf of health care providers or health plans, which is one reason a vendor’s security failure can reach patients who never dealt with the vendor directly.
The figure of 501 comes from the federal portal listing and should be read with care. The company has said its file review is not finished, so the final number of people affected could differ from the number first reported to regulators. Anyone who has used EZaccessMD’s services, or who received care through a provider that works with the company, may wish to treat the incident as relevant to them until the company confirms otherwise.
EZaccessMD’s own terms describe a membership platform that connects members with affiliated health care providers, including through video visits and in-home visits. A company in that position collects information that goes well beyond a name and address. It can hold details about a person’s symptoms, the physician involved, and diagnosis codes, which is exactly the kind of information the company lists as potentially affected in its notice. Health care and health technology organizations are frequent targets for network intrusions because the records they keep are detailed and long lasting.
The notable feature of this incident is how long the access window lasted. A month of unauthorized access gives an intruder time to browse folders, locate the most valuable files, and move data out of the environment. That general risk is why the company’s decision to bring in outside specialists matters, and why the outcome of its file review will be important. We will update this page if EZaccessMD or a regulator publishes new details, including confirmation of how many people were affected and how those individuals are being notified.
Under federal and state breach notification rules, organizations that handle protected health information are generally required to notify affected individuals without unreasonable delay after they determine whose information was involved. Because EZaccessMD has said its review is ongoing, individual letters are the next step to watch for. If a letter does arrive, read it closely, keep a copy, and note the date it was received. The wording of the letter, including which data elements are listed for you personally, can matter if you later need to document harm or discuss your options with an attorney.
If you believe you may be affected, the company has set up a dedicated phone line for questions, and its notice lists weekday daytime and evening hours, Eastern time. You can also reach out to us to talk about your situation. According to the company, it has no evidence that any potentially impacted information has been used to commit identity theft or fraud, but its statement also makes clear that its review of the information involved remains open.
When Did This Breach Occur?
EZaccessMD states that it discovered suspicious activity within its environment on or around July 30, 2026. Its investigation then determined that the unauthorized access took place between June 30, 2026 and July 30, 2026, a period of about one month during which certain files and folders were improperly accessed.
The company has not yet sent individual notice letters, because it says its review of the affected files is still underway. A report listing 501 affected individuals was submitted to the federal HHS breach portal on September 25, 2026. Totals may change as the review finishes, so check back for updates.
What Information Was Breached?
Based on the company’s investigation to date, the information potentially affected may include a combination of certain individuals’ name, relation, date of birth, gender, address, phone number, and Social Security number. The notice also lists health-related details: symptoms, physician name and ICD-10 codes, diagnosis, lab results, and medications.
The company emphasizes that this list is based on its work so far and that its review of the information involved is not complete. Not every person will have had every type of information exposed. The combination of identity details with medical details is what makes this kind of incident serious, since Social Security numbers support identity theft while diagnosis and medication data can be used for medical identity fraud or targeted scams.
What You Can Do
EZaccessMD encourages potentially affected individuals to stay vigilant against identity theft and fraud by reviewing account statements and monitoring free credit reports for suspicious activity and errors over the next 12 to 24 months. Consider these practical steps:
- Request your free credit reports from Equifax, Experian, and TransUnion through annualcreditreport.com and look for accounts you do not recognize.
- Place a fraud alert or a credit freeze with the credit bureaus. Both are free under federal law.
- Review explanations of benefits and medical bills for services you did not receive.
- Be cautious of calls, texts, or emails that mention your health conditions or medications, since criminals may use stolen details to sound credible.
- Keep any notice letter you receive and write down the date it arrived.
File a Data Breach Lawsuit Against EZaccessMD
When a company that holds health and identity information allows unauthorized access to its network, affected people may have legal options, including joining a class action to seek compensation for the risk and harm caused by the exposure. Class actions let many people with the same type of claim pursue it together, which can make it practical to hold a company accountable when each individual’s losses are small or hard to prove alone.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
