Tanner Clinic, a physician-owned medical group serving patients in Utah’s Davis and Weber counties, has been linked to a possible data breach by a ransomware group’s public claim. This page explains what has been reported, what has not been confirmed and what patients and employees can do now.
Everything below reflects public reporting and may change as the clinic releases its own information.
Tanner Clinic’s Data Breach Investigation
Tanner Clinic is a multispecialty healthcare provider based in Layton, Utah, with locations across Davis and Weber counties. Public descriptions of the organization say it offers urgent care, primary care and telehealth, along with specialty services such as dermatology, orthopedics, behavioral health and women’s health. A practice of that kind holds a wide range of sensitive records, from contact details and insurance information to medical histories and billing data.
The possible breach came to light through a listing on a dark web monitoring site, Ransomware.live, posted on November 12, 2026. The listing attributes the claim to a ransomware group called INC Ransom and gives an estimated attack date of October 28, 2026. A second cybersecurity news site reported the same day that the group had claimed responsibility for an attack on the clinic and had issued an extortion notice threatening to release patient data unless negotiations began.
It is important to be clear about the status of this information. A listing on a ransomware group’s leak site is a claim made by the people who say they carried out the attack. It is not a confirmation from the clinic, and such claims can turn out to be exaggerated, incomplete or, occasionally, wrong. At the time of writing, Tanner Clinic has not published a notice about a data security incident, and no state attorney general or federal regulator listing for the clinic has been identified.
As a result, the main facts that people want to know remain unanswered. No total number of affected people has been reported. The categories of information involved have not been confirmed. The clinic has not said whether patients, former patients, employees or others were affected, and it has not described how an intruder might have gotten into its systems or whether any data was actually copied.
Healthcare organizations are frequent targets of ransomware and extortion groups. Medical practices run on connected systems for scheduling, records, imaging and billing, and an outage can disrupt patient care, which gives attackers leverage. Many groups now steal data first and then threaten to publish it, so a claim of this kind often concerns information taken from the network rather than only files that were locked.
If patient records were taken, the exposure could be serious. Health information, when combined with names, addresses, dates of birth and Social Security numbers, can be used for identity theft, for fraudulent medical or insurance claims and for targeted phishing. Unlike a credit card number, a medical history cannot be replaced, which is why people often stay alert to misuse for a long time after an incident of this type. These risks are general to the healthcare sector and are not a statement about what was actually taken from Tanner Clinic.
Under state and federal rules, a healthcare provider that confirms a breach of protected health information generally has to notify the people affected, and larger incidents must also be reported to federal regulators and, in some cases, to state officials. Those notices usually arrive by mail weeks or months after an incident is discovered, because the organization first has to investigate and work out whose information was involved. The absence of a notice today therefore does not mean that nothing happened, and it does not mean that something did.
For now, the sensible approach is to treat the situation as a developing one. Watch for mail or email from Tanner Clinic, keep any notice you receive, and check the clinic’s official website and statements for updates. If you are a current or former patient or employee, you can take the protective steps below without waiting for confirmation, since they cost little and help in any case.
This page will not guess at details that have not been made public. If the clinic or a regulator publishes a fuller account, the dates, the data involved and the number of people affected are the first things to compare against anything you receive.
When Did This Breach Occur?
A ransomware-monitoring listing posted on November 12, 2026 gives an estimated attack date of October 28, 2026. That date comes from the listing itself and has not been confirmed by Tanner Clinic. The clinic has not said when any incident began, when it was discovered or when it was contained, and no notification date has been published. If the clinic releases a timeline, compare it with the date on any notice you receive.
What Information Was Breached?
The information involved has not been confirmed. The ransomware group’s statement, as reported, refers generally to sensitive patient data. Tanner Clinic has not published a notice listing which categories of information were affected, and no regulator filing has been identified. Because the clinic is a healthcare provider, records could include contact details, insurance information, billing data and medical information, but that is a general possibility and not a confirmed finding about this incident.
What You Can Do
If you received a notice related to Tanner Clinic or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Because the claim concerns a medical provider, review explanation-of-benefits statements and insurance records for services you did not receive, and ask your insurer to flag anything unfamiliar.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Tanner Clinic
Attorneys are looking into the reported Tanner Clinic data incident and want to hear from current and former patients and employees who believe their information may have been exposed. A lawsuit has not been confirmed, and whether you can seek compensation depends on what the clinic ultimately confirms about the incident. If you received a notice or suspect your information was involved, an attorney can explain whether you may be able to join a class action lawsuit.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
