Summary
- Environment: Patient information sent by email
- Operational impact: Patient file disclosed to an unintended recipient
- Financial impact: No financial loss quantified in the reviewed evidence
- Record status: Developing record. Reviewed October 17, 2026; updated as evidence emerges.
What happened
Neuro Wellness Spa accidentally emailed a patient-information file to another patient on August 24, 2026. The recipient reported the mistake on September 16. [1]
Impact
The file could contain names, care dates and locations, provider details, appointment or billing notes, chart and claim identifiers, and transaction details including check numbers. The provider said Social Security, driver’s license and credit-card numbers were absent. [1]
The reviewed notice gives no affected-person total.
Timeline
File misdirected
The file was emailed to the wrong patient.
[1]Error reported
The provider learned of the incident from the recipient.
[1]Patient notice issued
The patient notice was issued.
[1]Briefing updated
This briefing was last reviewed and updated on October 17, 2026.
Threat Group & Attack Vector
The documented cause is an accidental email disclosure. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
The provider requested deletion and no further use or sharing; confirmation of deletion was still pending. It investigated and strengthened security tools and staff training. [1]