---
title: "BASS Medical Group network data incident"
description: "BASS Medical Group disclosed possible access to or acquisition of files containing personal and healthcare information."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-24"
canonical_url: "https://www.ally.security/incidents/bass-medical-group-network-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/bass-medical-group-network-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/bass-medical-group-network-data-incident-2026/stix.json"
---

# BASS Medical Group network data incident

A network investigation identified possible exposure of treatment, billing and insurance information.

Last modified Oct 24, 2026 · 2 sources

## Summary

- **Environment:** Medical-group network and files containing patient information
- **Operational impact:** Possible exposure of personal and healthcare information
- **Financial impact:** No incident cost established in the reviewed evidence

## What happened

[BASS Medical Group](https://www.bassmedicalgroup.com/) detected suspicious network activity around September 4, 2026. Around September 22, its investigation determined that an unauthorized party may have accessed or acquired files. [1](#source-1) [2](#source-2)

## Impact

The information potentially involved included medical treatment codes, billing information and health-insurance information, with the fields varying by person. The notice did not establish a total affected population. [1](#source-1) [2](#source-2)

## Timeline

### October 22, 2026 — Data-security notice published

The [public notice](https://www.bassmedicalgroup.com/news/data-security-incident-notice-2026) described the investigation and possible information exposure. [2](#source-2)

### October 24, 2026 — Briefing updated

This briefing was last reviewed and updated on October 24, 2026.

## Threat Group & Attack Vector

The public notices describe unauthorized network activity but do not establish the initial access method, the start of access or an attacker identity. [1](#source-1) [2](#source-2)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

BASS said it secured the network, engaged outside specialists and strengthened safeguards. It notified the California Attorney General, the FBI and the U.S. Department of Health and Human Services Office for Civil Rights. [1](#source-1) [2](#source-2) Its October 22 notice said it knew of no misuse of the information and provided a call center for questions. That statement does not rule out unauthorized access. [2](#source-2)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/bass-medical-group-network-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### BASS Medical Group — California sample notification

official · BASS Medical Group · Oct 22, 2026

<https://oag.ca.gov/system/files/BASS%20-%20Preliminary%20Regulatory%20Notice%20Letter%20-%20CA_0.pdf>

<a id="source-2"></a>

### BASS Medical Group Notifies Individuals of Data Security Incident

official · BASS Medical Group · Oct 22, 2026

<https://www.bassmedicalgroup.com/news/data-security-incident-notice-2026>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Discovered At · 100% confidence · current**  
   BASS Medical Group network data incident: 2026-09-04
2. **Disclosed At · 100% confidence · current**  
   BASS Medical Group network data incident: 2026-10-22
3. **Resulted In · 100% confidence · current**  
   BASS Medical Group network data incident: Potentially involved information included medical treatment codes or billing information and health insurance information; the categories varied by individual.
4. **Occurred At · 100% confidence · current**  
   Public incident notice issued: 2026-10-22
5. **Resulted In · 100% confidence · current**  
   BASS Medical Group network data incident: BASS reported no evidence of misuse or attempted misuse in its October 22 notice.
6. **Resulted In · 100% confidence · current**  
   BASS Medical Group network data incident: Around September 22, the investigation determined that personal or protected health information may have been accessed or acquired without authorization.
7. **Resulted In · 100% confidence · current**  
   BASS Medical Group network data incident: BASS added safeguards and notified the California Attorney General, FBI and HHS Office for Civil Rights; it established a call center.
8. **Resulted In · 100% confidence · current**  
   BASS Medical Group network data incident: BASS discovered suspicious network activity around September 4, 2026 and secured its network while independent cybersecurity specialists investigated.
9. **Resulted In · 100% confidence · current**  
   BASS Medical Group network data incident: Public incident notice issued
10. **Affected Organization · 100% confidence · current**  
   BASS Medical Group network data incident: BASS Medical Group

</details>