Horizon Healthcare RCM hit by ransomware attack exposing patient data
Learn More
Horizon Healthcare RCM, a billing management company serving multiple healthcare providers reports a ransomware attack between December 25 and December 27, 2024, exposing sensitive patient information.
The breach was discovered on December 27, 2024, but the company did not notify affected individuals until June 27, 2025, creating a six-month delay between discovery and public notification.
The attack's cause was identified as a ransomware incident involving both system encryption and data exfiltration. The company reports they have arranged for the party responsible for this matter to delete the copied information. This possibly means they have paid some ransom. The compromised data types included:
- Internal Horizon numbers and customer numbers
- Patient identifiers and medical record numbers
- Names and addresses
- Social Security numbers
- Dates of birth
- Driver's license numbers
- Passport numbers
- Payment card information
- Checking and financial account information
- General health insurance claims processing information
- Non-address contact information
The number of affected individuals has not been disclosed.
The incident has not appeared on any dark web leak sites or criminal forums, which is additional evidence that the company negotiated with the threat actors and paid the demanded ransom. Cybersecurity experts warn that ransomware groups may retain copies of stolen data despite assurances of deletion, and organizations should not rely solely on criminal promises regarding data destruction.
