Cyberattack at Endue Software exposes personal and health data of over 118,000 individuals

Endue Software, a company specializing in infusion management platforms, has confirmed it was the target of a cyberattack that resulted in the unauthorized access and potential theft of sensitive personal and health information. The company disclosed the breach in a public notice dated April 11, 2025, detailing the timeline and extent of the incident.

According to Endue Software, suspicious activity within its internal systems was detected on February 17, 2025. A subsequent forensic investigation, aided by third-party cybersecurity experts, determined that an unauthorized actor had briefly gained access to certain systems the previous day, on February 16, 2025. During this brief window, the intruder was able to copy files containing confidential patient data.

The compromised information includes full names, residential addresses, dates of birth, Social Security numbers, and medical record numbers. The company has been conducting a comprehensive review of the stolen data since February in order to identify which clients and individuals may have been affected.

While Endue Software has officially reported the breach to the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) as impacting 118,028 individuals, the actual number of affected parties could be higher. This is due in part to some of Endue’s clients, such as Rheumatology Associates of Baltimore (RAB), choosing to report the breach independently. RAB has filed its own notification with OCR, listing 28,968 affected patients.

In response to the incident, Endue Software took immediate steps to secure its systems and engaged cybersecurity professionals to investigate and mitigate the breach. On April 11, the company began sending notification letters to impacted individuals, outlining the nature of the breach and the types of information involved. The company has also indicated that affected individuals may be eligible for compensation.