46,666 People Affected After Hackers Hit Healthcare Firm – Company Warns Data Now on Dark Web in ‘Limited Amount’

Tens of thousands of people are affected by a medical cybersecurity incident involving patient information.

According to a new filing with the Maine Attorney General, the incident at Alabama-based Heart South Cardiovascular Group affected 46,666 people, including three Maine residents. The healthcare firm says it learned on or about November 11, 2025 that an unauthorized party claimed to possess company data.

In a public notice, Heart South says a forensic investigation with outside cybersecurity professionals did not find evidence of unauthorized network access or data theft.

However, the company says it later discovered that a bad actor had recently posted a “limited amount” of patient data on the dark web. Heart South says it is notifying all patients whose protected health information was stored in the locations from which the posted data resided in its network.

The company says the potentially impacted information may include full names in combination with one or more of the following: Social Security numbers, dates of birth, treatments, procedures, diagnoses, medications and health insurance information.

It also says it has not been able to confirm whether any specific individual’s information was impacted. The firm says potentially impacted individuals were identified on February 12, 2026 and that notices began going out in April 2026.

Heart South is also offering complimentary identity monitoring services, while a law firm has launched an investigation into the incident.

Generated Image: Midjourney