Think Big Health Care Solutions has sent notice letters dated October 9, 2026 about a cybersecurity event that may have affected personal and health-related information. A copy of the notice was filed with the Massachusetts Attorney General’s office, and it does not state how many people were notified.
Think Big Health Care Solutions’s Data Breach Investigation
Think Big Health Care Solutions (Think Big) describes itself as a health care consulting and practice management business that provides services to medical practices, including patient billing, contracting and credentialing. In a notice letter dated October 9, 2026, it told recipients about a recent cybersecurity event that may have affected the security of some of their personal information. A copy of the letter was filed with the Massachusetts Attorney General and posted in the state’s public list of data breach notification letters. Massachusetts requires organizations that experience a breach involving residents’ personal information to notify those residents and state regulators, and the Commonwealth publishes the notices it receives.
The letter explains that Think Big may have received some recipients’ information because those people, or their information, are associated with Optimotion Orthopaedics, a medical practice that Think Big has provided services to. The letter does not name a date for the event, does not explain how the intruder got in, and does not say how long any unauthorized access lasted. This page does not guess at any of those facts.
The letter says Think Big’s review found the following information about the recipient in the affected files and emails: name, claims information, medical record number and procedure codes. That combination is health-related rather than purely financial. Claims information and procedure codes can indicate what care a person received, and a medical record number ties details to a patient’s chart at a medical practice. Health details like these can be used in targeted phishing or in attempts at medical identity fraud, which is one reason regulators ask organizations to notify people promptly.
Business partners of medical practices, such as billing and practice management firms, often hold patient information so they can submit claims and manage payments. Patients usually have no direct relationship with these companies, so an incident at a service provider can reach people who have never heard of the company that was affected. That is why the notice takes the trouble to explain how Think Big received the recipient’s information.
According to the letter, Think Big responded by taking steps to secure its systems, investigate what occurred and review all data at risk to identify the people whose information may have been involved. It says it reviewed its security policies and procedures, conducted additional staff training and put additional technical safeguards and enhanced security measures in place. It also says it notified law enforcement and that the notice was not delayed by a law enforcement investigation. Think Big says it is unaware of any attempted or actual fraudulent misuse of the information.
As a precaution, Think Big is offering single-bureau credit monitoring, a single-bureau credit report and a single-bureau credit score at no charge, with alerts for 24 months from the date of enrollment. The services are provided by Cyberscout, a TransUnion company that specializes in fraud assistance and remediation. Recipients must enroll themselves, using a unique code in their own letter, within 90 days of the date of the letter. The company says it cannot enroll people on their behalf.
The filing does not say how many people received the letter. A notice filed in one state does not mean only residents of that state were affected, since service providers that work with practices in several places may send similar letters to people in each of them. The number of people notified overall may therefore be larger than the number tied to any single filing.
A notice filed with a state regulator shows that the organization concluded the event met a legal reporting threshold. It is not a finding of fault, and it does not by itself answer whether the safeguards in place were adequate. Those are the kinds of questions that attorneys can ask on behalf of people who were harmed.
When Did This Breach Occur?
The notice letter is dated October 9, 2026. The sources reviewed do not state when the cybersecurity event occurred or when Think Big discovered it. Recipients have 90 days from the date of the letter to enroll in the offered credit monitoring. Check your own letter for any other dates.
What Information Was Breached?
The letter says the affected files and emails contained the recipient’s name, claims information, medical record number and procedure codes. It does not list Social Security numbers, financial account numbers or insurance details among the items identified. Your own letter should state which of your details were involved.
What You Can Do
If you received a notice from Think Big Health Care Solutions, or believe you may be affected, consider these steps:
- Read your letter closely and enroll in the free Cyberscout credit monitoring using the code in your letter within 90 days of the letter date.
- Review explanation of benefits statements from your health insurer and statements from your providers for services you did not receive.
- Place a free fraud alert on your credit file, or consider a free security freeze, with Equifax, Experian and TransUnion, and get free reports at annualcreditreport.com.
- Be cautious with emails, texts or calls that mention your care or claims, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov and to your state Attorney General.
File a Data Breach Lawsuit Against Think Big Health Care Solutions
If you received a notice about this incident, or believe your health information was exposed, you may have legal options. Companies that handle patient information are expected to safeguard it, and a class action can help hold them accountable when they fail to do so.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
