IMS Care Center, a Phoenix, Arizona health care organization, has reported a data event involving unauthorized access to its email environment. The company says names, addresses, Social Security numbers and medical information may have been exposed. Health care organizations are responsible for protecting the sensitive records they hold.
IMS Care Center’s Data Breach Investigation
IMS Care Center, LLC is located at 3815 East Bell Road, Suite 4500, in Phoenix, Arizona. The public account of its incident comes from a notice that its outside law firm, Wilson Elser, sent to the New Hampshire Attorney General on October 16, 2026, together with a sample of the letter mailed to affected people. The notice describes the incident as a data event and does not say what kind of services IMS provides beyond the medical information that was involved.
According to the notice, IMS became aware of unusual activity in its email environment on or about June 18, 2026. It began an investigation right away and hired outside experts. That investigation found that certain information may have been accessed without authorization between June 17, 2026 and June 18, 2026. The notice does not say how the unauthorized person got into the email environment or who was responsible.
Finding out that an email system was accessed is only the first step. IMS says it then began a comprehensive review of the data set to work out what sensitive or personal information was in it and whom that information related to. It finished that review on September 30, 2026, more than three months after it first noticed the activity. Letters to affected people were mailed on October 16, 2026.
The company says the data that may have been exposed included name, address, Social Security number and medical information. The notice to affected people adds that the impacted information varied by individual, so not everyone had every item involved. IMS states that it is unaware of any actual or attempted misuse of information to commit fraud.
The filing reports that one New Hampshire resident was determined to be potentially affected. That is only the New Hampshire count. The filing does not say how many people were notified in total across all states, and this page does not estimate a total.
IMS says it engaged a specialized cybersecurity firm to run a forensic investigation. It also says it added new technical safeguards, including managed detection and response monitoring from Sophos, restricted the locations from which people can log in and limited system access, increased phishing training, trained or retrained its workforce, and revised its policies and procedures. It offered at least twelve months of complimentary credit monitoring and identity theft restoration through Cyberscout, a TransUnion company.
Email accounts are a common target in health care because messages and attachments pile up over years and can hold referrals, insurance forms, lab results and scanned identification. An intruder who gets into a mailbox does not need to break into a records system to find them. Reviewing every file in a mailbox for personal data is slow, which helps explain why months can pass between the intrusion and the notice. This is general industry context and is not a finding about how the intrusion at IMS happened.
Medical details paired with a Social Security number are a particularly sensitive combination. A Social Security number can support tax and credit fraud and does not expire, while medical information can be used for medical identity theft or for scams that sound convincing because they mention a real condition or provider. Medical history cannot be changed the way a password can, so people who receive this kind of notice have good reason to stay watchful for a long time.
If you received a letter from IMS, keep it and use only the contact information printed in it. Scammers sometimes follow publicized incidents with fake calls, texts or emails that claim to come from the affected company. Do not give out personal information to anyone who contacts you unexpectedly about this incident, and treat the details in your own letter as controlling over anything general in this article.
When Did This Breach Occur?
IMS says it became aware of unusual activity in its email environment on or about June 18, 2026, and that information may have been accessed between June 17, 2026 and June 18, 2026. It finished reviewing the affected data on September 30, 2026, and mailed notification letters on October 16, 2026.
What Information Was Breached?
According to the notice, the information that may have been exposed included name, address, Social Security number and medical information.
The notice to individuals says the affected information varied by person.
What You Can Do
If you received a notice related to IMS Care Center or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the Cyberscout credit monitoring offered in your letter, consider a credit freeze because a Social Security number was involved, and review insurer statements for medical services you did not receive.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against IMS Care Center
If you were notified that your Social Security number or medical information was exposed in the incident involving IMS Care Center, you may have legal options. Health care organizations are expected to safeguard patient information, and a class action can help hold them accountable when they fall short.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
