EHR Vendor Accumedic Confirms Patient Health Data Exposure
Accumedic Computer Systems, an electronic health record vendor, confirmed on September 1, 2026 that patient health information was exposed and potentially obtained after an intruder first accessed its network on April 8, 2026. Data includes names, dates of birth, Social Security numbers, medical information, and health insurance information. New York clinics are notifying affected patients, who should watch for misuse of their information; Accumedic says additional technical safeguards have been implemented.
What happened
An intruder first accessed the network of Accumedic Computer Systems, an electronic health record vendor, on April 8, 2026. The company confirmed on September 1 that patient information was exposed and potentially obtained between June 4 and June 8, 2026. New York clinics such as Hispanic Counseling Center began notifying patients on October 30.
Why it matters
Exposed data includes names, dates of birth, Social Security numbers, medical information, and health insurance information, enabling identity theft and health insurance fraud. Mental health and substance use disorder clinics are affected, with regulatory (HIPAA) and patient trust implications. The source reports no operational disruption at the vendor.
What to do
Confirm whether your organization uses Accumedic and which records were affected. Advise affected patients to monitor credit and health insurance accounts. Review with the vendor the additional technical safeguards now in place.
For the technical team
- Affected
- Accumedic Computer Systems, fornecedor de prontuário eletrônico (EHR); pacientes das clínicas Hispanic Counseling Center · Customers of Accumedic Computer Systems, an electronic health record vendor; affected patients include those of Hispanic Counseling Center (mental health and substance use disorder clinic, Long Island, New York) and Brooklyn Counseling Services.
- Exploitation
- Potential exfiltration of customer information between June 4 and June 8, 2026, confirmed by Accumedic itself on September 1, 2026 and reported by HIPAA Journal. No mention of ransomware, PoC, or KEV in the source.
- Fix
- No software fix applicable (data breach incident). Accumedic states that additional technical safeguards have been implemented to prevent similar incidents.
- Vector
- Unauthorized access to the Accumedic Computer Systems corporate network, detected through suspicious activity on June 8, 2026. The source does not describe the initial technical vector or exploitation preconditions.
- More details
- Investigation conducted by engaged third-party cybersecurity experts after detection on June 8, 2026. Data types involved: names, dates of birth, Social Security numbers, medical information, and health insurance information. Hispanic Counseling Center began notifying affected individuals on October 30 via mailed letters. The source does not state the total number of patients affected.
Timeline
Incident opened.
