Grandview Family Medicine, a family-oriented medical practice in Provo, Utah, has reported a data breach affecting 13,310 people. Details about what information was involved have not yet been made public.
Grandview Family Medicine’s Data Breach Investigation
Grandview Family Medicine is a family-oriented medical practice based in Provo, Utah, offering primary care services to families in the area. The practice has reported a data breach that affected 13,310 individuals in the United States, according to the federal breach listing that regulators publish for health care providers. Because the organization is a covered health care provider, the incident was submitted to the U.S. Department of Health and Human Services Office for Civil Rights, which is where the number of people affected first became public.
The filing was made on April 6, 2026. The federal listing classifies the event as a hacking or IT incident, and records that the affected information was held on a network server. It does not list a business associate as being involved. At the time of writing, the case still appears among those that federal regulators are reviewing, and no closing summary has been published describing what was exposed or what the practice did afterward.
Separately, a ransomware group known as Medusa posted a claim on the Tor network on February 8, 2026, stating that it had obtained data belonging to Grandview Family Medicine. According to published reports of that posting, the group said it intended to release the stolen material if it was not paid. We have not seen a statement from the practice confirming that the claim is connected to the filing, and we have not verified what, if anything, was actually published. The claim is reported here only as something that has been publicly attributed to the group, not as an established fact about the practice’s systems.
The practice itself has told patients who are worried about their information to contact the clinic directly. Its main clinic is located on North State Street in Provo. Patients who have received care there, including those who may not have been seen in years, may want to use that route to ask whether their records were involved, since the practice has not publicly posted a detailed list of the people or record types affected.
At this time, the specific types of personal or health information that may have been compromised have not been detailed in the publicly available filings we reviewed. Summary listings from third-party trackers show a generic checklist of categories, but those lists are templates and do not come from a notice by the practice, so we do not treat them as confirmed. Until the practice or a regulator provides specifics, anyone who was a patient should assume that identifying and medical details could have been involved and act accordingly.
It is also worth understanding why a family medicine practice is an attractive target. Primary care files tend to hold a wide mix of information in one place: names, home addresses, dates of birth, insurance details, and treatment histories that span every member of a household. Ransomware groups that threaten to publish stolen data are betting that the sensitivity of medical records will pressure a practice into paying. That context is general to the health care sector and is not a finding about how this particular incident unfolded.
For the people affected, the practical risk is not limited to one kind of fraud. Identity details can be used to open accounts or file false tax returns, while medical and insurance details can be used for medical identity theft, in which someone receives care or files claims under another person’s name. Medical identity theft is often slow to surface, because the first sign may be an unexpected bill or an insurer’s statement for services that were never received.
Multi-state notice is a common feature of larger health care breaches. When a practice has to notify patients who live in several states, it may also file notices with state attorneys general. Those filings can carry different figures and wording than the federal listing, so the totals and descriptions published about an incident can vary from one source to the next. We will treat the federal figure of 13,310 as the reported total for this page unless the practice publishes a different number.
Class Action U is following this incident. If you received a letter from Grandview Family Medicine, or you were a patient and believe your information may have been involved, understanding what your notice says and acting early to protect your accounts are the most useful first steps. You do not need to wait for more details to be published before taking those steps, and keeping a record of any suspicious activity, bills, or messages will matter if you later decide to pursue a claim.
When Did This Breach Occur?
A ransomware group known as Medusa posted a claim on the Tor network on February 8, 2026, saying it had obtained data belonging to Grandview Family Medicine. The practice has not publicly confirmed the date of the underlying intrusion or the date it first detected suspicious activity.
The incident was reported to the U.S. Department of Health and Human Services on April 6, 2026. No individual notification date has been published in the sources we reviewed.
What Information Was Breached?
Grandview Family Medicine has not publicly detailed which types of personal or health information were affected. The filings we reviewed do not include a list of data types.
Because the practice provides medical care, records at a practice like this can generally include identifying details and health information. That is a general observation, not a confirmed description of what was taken.
What You Can Do
The practice has asked concerned patients to reach out to the clinic directly. These steps can also help:
- Contact the practice directly if you were a patient and want to ask whether your records were involved.
- Review bank and card statements, credit reports and insurance explanations of benefits for charges or services you do not recognize.
- Request your free credit reports from each major bureau at annualcreditreport.com.
- Consider a free fraud alert or credit freeze, including for a child whose information may have been involved.
- Be cautious with calls, texts and emails that reference this incident, and confirm them through an official contact first.
File a Data Breach Lawsuit Against Grandview Family Medicine
Data breach claims generally rest on whether an organization took reasonable steps to protect the sensitive information it held. Because this incident involves a medical practice and a reported total of 13,310 people, the stakes for those affected can be significant.
People affected may be able to seek compensation for out-of-pocket costs, time spent protecting themselves, and the ongoing risk of identity theft. A lawyer experienced in class actions can review your situation and explain your options.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
