113,330 Americans Affected After ‘Unauthorized Third Party’ Breaches Healthcare Firm, Trove of Personal, Financial and Medical Data at Risk

A security incident involving a Colorado-based healthcare provider has put at risk the sensitive data of thousands of Americans.

In a letter to affected individuals, Western Orthopaedics, P.C. (Western Ortho) says that between September 17th, 2025 and September 25th, 2025, an unauthorized third party accessed and acquired certain data contained within its network. The firm says it became aware of the incident on October 2nd, 2025. 

Western Ortho then took steps to secure its network and conducted an investigation with the assistance of its contracted cybersecurity team and external cybersecurity experts.  

The analysis, which concluded on March 3rd, showed that the event compromised a trove of patients’ data, including full names and addresses; phone numbers; Social Security numbers; dates of birth; financial accounts and credit/debit card numbers with or without the required security code, access code or password. 

The incident also exposed protected health information, including health insurance information, health insurance plans or subscriber identification numbers, names of medical providers, medical dates of service and medical costs or billing information.

Western Ortho is providing affected individuals with free credit monitoring and identity protection services albeit the firm says that it did not find any indication of identity theft or fraud in relation to the hacking incident.

The Office for Civil Rights of the U.S. Department of Health and Human Services says that 113,330 individuals were affected by the breach.

Generated Image: Midjourney