Karen Horney Clinic has told people that a data security incident at one of its vendors may have involved their personal information. This page explains what the notice says, what it leaves out and what you can do.
The notice was filed with the Massachusetts Attorney General in November 2026 and is titled as a notice of a vendor data breach.
Karen Horney Clinic’s Data Breach Investigation
Karen Horney Clinic is a health care provider that relies on an outside company for its electronic medical records. According to the notice, that company is Accumedic Computer Systems, Inc., which provides electronic medical records services to a range of health care organizations and providers. The incident described in the notice took place on the vendor’s systems, not on the clinic’s own network.
The letter says Accumedic notified the clinic on August 25, 2026 that a cyber incident had affected its systems and disrupted its services. Accumedic then isolated the affected servers, notified law enforcement and began an investigation with the help of third-party forensic experts. The notice says the company has restored its systems and operations, is cooperating with the continuing law enforcement investigation and has taken further steps to harden the security of its systems and networks.
The letter reports the investigation’s findings. It says that on August 7, 2026, the investigation determined that an unauthorized third party first gained access to Accumedic’s systems on or around April 8, 2026, and potentially obtained personal information between June 4 and 8, 2026. The dates are reported here as the letter gives them. They suggest that access went on for some time before the period in which data may have been taken.
After that, the company says it carried out a detailed review of the affected files with a dedicated team of internal and external experts, to work out which people and which kinds of information were involved. The notice explains that this analysis was time-consuming because of the nature and complexity of the data. The people receiving the notice are those whose personal information was contained in the affected files.
The notice says there is currently no evidence or indication of actual or attempted misuse of personal information. That statement reflects what the company knew when the notice was written. It does not guarantee that nothing will happen later, since stolen data is sometimes held for a long time before anyone uses it.
The copy filed with the Massachusetts Attorney General is an unfilled sample of the mailed letter. Where the real letter would name the recipient and list the categories of information involved, the filing shows blank merge placeholders instead. For that reason this page cannot say which data elements were involved for any person, and it does not guess. The notice does say that each affected person’s name was among the information in the affected files.
The filing also does not give a total number of people affected. It offers a toll-free assistance line for questions and says that credit monitoring and identity restoration services are available through Epiq at no charge. The length of that offer and the enrollment deadline are also left blank in the sample, so people should read the dates in their own letter.
Incidents at a record-keeping vendor can reach many people at once, because a single provider holds information for many client organizations. That is why people sometimes learn about a breach from a company they have never dealt with directly. If you were a patient of the clinic, the notice may be the first time you hear the vendor’s name. Health information is especially sensitive because it cannot be changed the way a password or card number can, so people often stay alert for misuse over a long period after any notice of this type, whether or not the company reports any misuse.
Until more is published, the sensible approach is to treat the notice as a prompt to take simple protective steps, keep the letter, and use the enrollment instructions in it. Anyone who believes they should have received a notice but did not can contact the clinic directly using official contact details.
When Did This Breach Occur?
According to the notice, Accumedic told the clinic on August 25, 2026 about a cyber incident that disrupted its services. The vendor’s investigation determined on August 7, 2026 that an unauthorized third party first gained access on or around April 8, 2026, and that personal information was potentially obtained between June 4 and 8, 2026. The filed copy of the letter has a blank where the mailing date would appear, so the notice date is not stated here.
What Information Was Breached?
The notice says the affected files contained each person’s name together with other data elements, but the filed copy leaves that list as a blank placeholder. The specific categories of information are therefore not confirmed in the public filing. Because the vendor handles electronic medical records, information held in those systems can include health and insurance details, but that is a general possibility and not a confirmed finding about this incident. Check your own letter for the items that apply to you.
What You Can Do
If you received a notice related to Karen Horney Clinic or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the credit monitoring and identity restoration services offered through Epiq, using the activation code and deadline in your own letter, and call the toll-free line in the notice if you have questions.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Karen Horney Clinic
Attorneys are looking into the Accumedic vendor incident reported by Karen Horney Clinic and want to hear from people who received a notice or who believe their information was in the affected files. No lawsuit has been confirmed. Whether you can seek compensation depends on what is ultimately disclosed about the incident. An attorney can explain whether you may be able to join a class action lawsuit.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
