Bradford Health Services reports 2023 data breach, compromising patient and staff data

Alabama-based Bradford Health Services said a data security incident it suffered in 2023 compromised the sensitive personal information of its patients and staff.

 

Bradford Health, one of the leading healthcare providers in the Birmingham, Alabama area, specialises in inpatient care, outpatient programs, and detoxification services for individuals in need of comprehensive treatment..

 

On May 30, in a data security incident notice published on its website, Bradford Health said that on December 8, 2023, it detected unusual activity within its internal network. The healthcare provider immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

“The investigation determined that certain files stored on the network may have been accessed and acquired without authorisation. After a thorough review of those files, which concluded on May 15, 2025, Bradford Health determined that certain individuals’ personal and/or protected health information may have been affected,” Bradford Health said.

 

The compromised data included names, Social Security numbers, driver’s license numbers, dates of birth, medical information (including diagnosis and treatment information, physician names, and Medical Record numbers), health insurance information, financial account numbers, passport numbers and payment card numbers.

 

At the time of publishing, the incident has not yet been listed on the HHS Office for Civil Rights website, leaving the number of individuals affected unclear.

 

“Bradford Health has implemented additional measures to enhance network security and minimise the risk of a similar incident occurring in the future. Bradford Health also reported the incident to the law enforcement,” the healthcare provider added.

 

While Bradford Health found no evidence of the compromised information being misused, it advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.

 

 

In January last year, the Hunters International group claimed responsibility for the cyber attack on Bradford Health and listed it as a victim on its data leak site. The group claimed to be in possession of 769.7 GB of data, consisting of 626,837 files, including agreements, medical records, SQL backups, employee data, and business-related data and threatened to publish it unless their ransom demands were fulfilled