Unlimited Technology Systems (UTS), an Ohio-based medical software vendor, has disclosed that an unauthorized actor may have copied protected health information belonging to 3.8 million people during an October 2025 intrusion at its commercial datacenter. According to the US Department of Health and Human Services' breach portal, the incident affects the PHI of 3,803,750 individuals, making it the largest healthcare breach reported to regulators so far in 2026. The company confirmed the compromise in July but has not yet named the threat actor or detailed the initial access method. Affected individuals are being offered 24 months of credit monitoring and identity protection services.
Timeline of the incident
UTS first detected signs of unauthorized activity in its commercial datacenter in October 2025. In a notification letter filed with the Iowa attorney general, the company states that an unauthorized actor may have copied personal information from its systems between October 5 and 10, 2025. UTS publicly disclosed the breach in July but initially withheld the affected headcount, which it has now revised upward to 3,803,750 people.
Following detection, UTS engaged a forensic security firm, notified law enforcement, and began determining which files the intruder had accessed. To date, the company has not publicly attributed the attack or explained how the intruder gained access to the datacenter environment. UTS says it is unaware of any attempted or actual misuse of the compromised information.
Potentially exposed data
Depending on the individual, the exfiltrated files may contain names, Social Security numbers, dates of birth, home and email addresses, phone numbers, and other demographic information. The stolen data also encompasses medical and insurance records, including policy numbers, claims and benefits information, patient balances, medical record numbers, dates of service, and diagnoses.
The files may additionally have included scans of driver's licenses and other government-issued IDs, insurance cards, and patient intake forms. UTS emphasizes some limits to the exposure: the affected files did not contain complete medical records, medical images, credit card numbers, or bank account details.
Scale and industry context
At 3.8 million affected individuals, the UTS incident surpasses the 3.4 million-person TriZetto Provider Solutions breach as the largest healthcare data breach reported to HHS so far in 2026. The pattern underscores that targeting third-party data handlers and software vendors can yield millions of healthcare records in a single intrusion, compared with the comparatively limited reach of attacks on individual hospitals.
Technical background
The following is a general explanation of how this class of compromise typically unfolds, based on well-established public knowledge — it is not a description of the specific UTS intrusion, whose technical details have not been publicly disclosed.
Compromises of managed datacenter and software-vendor environments commonly begin with a single foothold — for example, a phished credential, an exposed management interface, or an unpatched service — after which the attacker enumerates the network and hunts for accounts with access to file shares and databases. Data theft in these environments frequently moves over standard protocols that blend into normal traffic, making detection reliant on anomalous patterns rather than any single signature.
Defenders can apply generic detection and hardening measures to surface such activity:
# Enumerate large directory listings that may indicate bulk collection
ls -la /path/to/patient/share
# Review remote-access connections and active sessions during the incident window
last -i
ss -tnp | grep -E ':(445|1433|3389|22)\s'
# Look for signs of archive creation (staging) before exfiltration
find /path/to/data -name '*.zip' -o -name '*.7z' -o -name '*.tar' 2>/dev/null
# Review PowerShell history for staging or download activity
Get-History | Format-List CommandLine
# Check for scheduled tasks added around the suspected intrusion window
Get-ScheduledTask | Where-Object { $_.Author -ne "Microsoft" }
Best-practice mitigations for healthcare data custodians include enforcing multi-factor authentication on all remote access paths, segmenting environments so that clinical data shares are not reachable from management networks, enabling file integrity monitoring on sensitive directories, and maintaining detailed audit logging of file-server and database access. Given that notification thresholds such as those set by the HHS Breach Notification Rule trigger reporting to the breach portal and state attorneys general, organizations should also rehearse their disclosure workflows in advance of an incident rather than during one.