--- title: "Neuro Wellness Spa patient-file email disclosure" description: "Neuro Wellness Spa accidentally emailed a patient-information file to another patient on August 24, 2026." incident_type: "Data incident" status: "active" last_modified: "2026-10-17" canonical_url: "https://www.ally.security/incidents/neuro-wellness-spa-email-disclosure-2026" markdown_url: "https://www.ally.security/incidents/neuro-wellness-spa-email-disclosure-2026.md" stix_url: "https://www.ally.security/incidents/neuro-wellness-spa-email-disclosure-2026/stix.json" --- # Neuro Wellness Spa patient-file email disclosure A misdirected email disclosed patient information; deletion confirmation remained pending in the October notice. Last modified Oct 17, 2026 · 1 source ## Summary - **Environment:** Patient information sent by email - **Operational impact:** Patient file disclosed to an unintended recipient - **Financial impact:** No financial loss quantified in the reviewed evidence ## What happened [Neuro Wellness Spa](https://neurowellnessspa.com/) accidentally emailed a patient-information file to another patient on August 24, 2026. The recipient reported the mistake on September 16. [1](#source-1) ## Impact The file could contain names, care dates and locations, provider details, appointment or billing notes, chart and claim identifiers, and transaction details including check numbers. The provider said Social Security, driver's license and credit-card numbers were absent. [1](#source-1) The reviewed notice gives no affected-person total. ## Timeline ### August 24, 2026 — File misdirected The file was emailed to the wrong patient. [1](#source-1) ### September 16, 2026 — Error reported The provider learned of the incident from the recipient. [1](#source-1) ### October 9, 2026 — Patient notice issued The [patient notice](https://oag.ca.gov/system/files/DATA%20BREACH%20NOTICE%20-%20NWS.pdf) was issued. [1](#source-1) ### October 17, 2026 — Briefing updated This briefing was last reviewed and updated on October 17, 2026. ## Threat Group & Attack Vector The documented cause is an accidental email disclosure. [1](#source-1) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response The provider requested deletion and no further use or sharing; confirmation of deletion was still pending. It investigated and strengthened security tools and staff training. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Neuro Wellness Spa — Notice of Data Breach official · Neuro Wellness Spa · Oct 9, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** Neuro Wellness Spa patient-file email disclosure: Patient notice issued 2. **Occurred At · 100% confidence · current** Patient notice issued: 2026-10-09 3. **Exposed Data Category · 100% confidence · current** Patient information sent to an unintended recipient: Clinical information 4. **Resulted In · 100% confidence · current** Patient notice issued: The provider issued its patient notice. 5. **Affected Organization · 100% confidence · current** Neuro Wellness Spa patient-file email disclosure: Neuro Wellness Spa 6. **Occurred At · 100% confidence · current** Neuro Wellness Spa patient-file email disclosure: 2026-08-24 7. **Occurred At · 100% confidence · current** File sent to wrong recipient: 2026-08-24 8. **Resulted In · 100% confidence · current** Neuro Wellness Spa patient-file email disclosure: File sent to wrong recipient 9. **Resulted In · 100% confidence · current** Neuro Wellness Spa patient-file email disclosure: Potential fields included names, service dates and locations, providers, exam-room or telehealth information, appointment/billing/service notes, chart and claim identifiers, payment dates/methods/amounts, procedure codes and check numbers. 10. **Exposed Data Category · 100% confidence · current** Patient information sent to an unintended recipient: Healthcare billing and claims information 11. **Exposed Data Category · 100% confidence · current** Patient information sent to an unintended recipient: Names 12. **Resulted In · 100% confidence · current** Neuro Wellness Spa patient-file email disclosure: Neuro Wellness Spa said Social Security numbers, driver’s license numbers and credit-card numbers were not in the file. 13. **Resulted In · 100% confidence · current** File sent to wrong recipient: The patient-information file was emailed inadvertently. 14. **Resulted In · 100% confidence · current** Neuro Wellness Spa patient-file email disclosure: The provider investigated and enhanced security tools and workforce training on handling protected health information. 15. **Resulted In · 100% confidence · current** Neuro Wellness Spa patient-file email disclosure: Patient information sent to an unintended recipient 16. **Exposed Data Category · 100% confidence · current** Patient information sent to an unintended recipient: Financial transaction information 17. **Discovered At · 100% confidence · current** Neuro Wellness Spa patient-file email disclosure: 2026-09-16 18. **Disclosed At · 100% confidence · current** Neuro Wellness Spa patient-file email disclosure: 2026-10-09 19. **Resulted In · 100% confidence · current** Recipient reported the error: Neuro Wellness Spa became aware of the disclosure. 20. **Resulted In · 100% confidence · current** Neuro Wellness Spa patient-file email disclosure: Recipient reported the error 21. **Occurred At · 100% confidence · current** Recipient reported the error: 2026-09-16 22. **Resulted In · 100% confidence · current** Neuro Wellness Spa patient-file email disclosure: A file containing patient information was inadvertently emailed to another patient instead of the intended document on August 24, 2026. 23. **Exposed Data Category · 100% confidence · current** Patient information sent to an unintended recipient: Patient account numbers 24. **Resulted In · 100% confidence · current** Neuro Wellness Spa patient-file email disclosure: The recipient reported the error on September 16, 2026. 25. **Resulted In · 100% confidence · current** Neuro Wellness Spa patient-file email disclosure: The provider requested deletion and asked the recipient not to use or share the information; confirmation of deletion remained in progress.