Incident BriefingsBASS Medical Group network data incident

BASS Medical Group network data incident

A network investigation identified possible exposure of treatment, billing and insurance information.

Last modified

Summary

  • Environment: Medical-group network and files containing patient information
  • Operational impact: Possible exposure of personal and healthcare information
  • Financial impact: No incident cost established in the reviewed evidence
  • Record status: Developing record. Reviewed October 24, 2026; updated as evidence emerges.

What happened

BASS Medical Group detected suspicious network activity around September 4, 2026. Around September 22, its investigation determined that an unauthorized party may have accessed or acquired files. [1][2]

Impact

The information potentially involved included medical treatment codes, billing information and health-insurance information, with the fields varying by person. The notice did not establish a total affected population. [1][2]

Timeline

  1. Data-security notice published

    The public notice described the investigation and possible information exposure.

    [2]

  2. Briefing updated

    This briefing was last reviewed and updated on October 24, 2026.

Threat Group & Attack Vector

The public notices describe unauthorized network activity but do not establish the initial access method, the start of access or an attacker identity. [1][2]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

BASS said it secured the network, engaged outside specialists and strengthened safeguards. It notified the California Attorney General, the FBI and the U.S. Department of Health and Human Services Office for Civil Rights. [1][2] Its October 22 notice said it knew of no misuse of the information and provided a call center for questions. That statement does not rule out unauthorized access. [2]