EHR vendor Accumedic Computer Systems breach exposes patient data at New York counselling providers
Hispanic Counseling Center (Long Island, New York) and Brooklyn Counseling Services (BCS Group / BCS Counselling Group) are notifying patients that personal and protected health information was compromised in a security incident at their electronic medical record vendor, Accumedic Computer Systems, which supplies EHR software for behavioral health providers. Accumedic detected suspicious activity on its network on June 8, 2026, and its third-party forensic investigation concluded on August 7, 2026 that an unauthorized third party first gained access on April 8, 2026 and potentially exfiltrated customer data between June 4 and June 8, 2026. Data review completed on September 1, 2026 confirmed exposure of patient health information. Hispanic Counseling Center began mailing letters on October 30, 2026; the exposed data includes names, dates of birth, Social Security numbers, medical information and health insurance information. Brooklyn Counseling Services' letters cite names, email addresses, phone numbers, dates of birth, Social Security numbers and health records, and do not name the vendor, though the timing points to the same incident. Total victim counts remain undisclosed; the incident is reported to affect one Massachusetts resident and two Vermont residents, with most victims expected to be New York residents, and the New York Attorney General does not publish breach totals. No public reporting identifies a threat actor, ransomware group or extortion claim, and no searches of public sources located a statement from Accumedic Computer Systems itself on this incident.
Detalhes técnicos
The article does not describe the intrusion method, malware or indicators. The dwell time between initial access (April 8, 2026) and detection (June 8, 2026) is roughly two months, with data staging and potential exfiltration in the final four days. The exposure of Social Security numbers alongside behavioral health and substance use disorder treatment records makes this a high-sensitivity dataset for the affected population.
Remediação
Accumedic Computer Systems states that additional technical safeguards have been implemented. Complimentary credit monitoring is offered to individuals notified by Hispanic Counseling Center. Covered entities using Accumedic should request the vendor's incident report and forensic findings, verify whether their patient records were in scope, and meet HIPAA Breach Notification Rule timelines; affected individuals should monitor for identity theft and medical identity fraud.
Linha do tempo
-
EHR vendor Accumedic Computer Systems breach exposes patient data at New York counselling providers
ler a análise desta fonte ocultar
Hispanic Counseling Center (Long Island, New York) and Brooklyn Counseling Services (BCS Group / BCS Counselling Group) are notifying patients that personal and protected health information was compromised in a security incident at their electronic medical record vendor, Accumedic Computer Systems, which supplies EHR software for behavioral health providers. Accumedic detected suspicious activity on its network on June 8, 2026, and its third-party forensic investigation concluded on August 7, 2026 that an unauthorized third party first gained access on April 8, 2026 and potentially exfiltrated customer data between June 4 and June 8, 2026. Data review completed on September 1, 2026 confirmed exposure of patient health information. Hispanic Counseling Center began mailing letters on October 30, 2026; the exposed data includes names, dates of birth, Social Security numbers, medical information and health insurance information. Brooklyn Counseling Services' letters cite names, email addresses, phone numbers, dates of birth, Social Security numbers and health records, and do not name the vendor, though the timing points to the same incident. Total victim counts remain undisclosed; the incident is reported to affect one Massachusetts resident and two Vermont residents, with most victims expected to be New York residents, and the New York Attorney General does not publish breach totals. No public reporting identifies a threat actor, ransomware group or extortion claim, and no searches of public sources located a statement from Accumedic Computer Systems itself on this incident.
Technical Details
The article does not describe the intrusion method, malware or indicators. The dwell time between initial access (April 8, 2026) and detection (June 8, 2026) is roughly two months, with data staging and potential exfiltration in the final four days. The exposure of Social Security numbers alongside behavioral health and substance use disorder treatment records makes this a high-sensitivity dataset for the affected population.
Remediation
Accumedic Computer Systems states that additional technical safeguards have been implemented. Complimentary credit monitoring is offered to individuals notified by Hispanic Counseling Center. Covered entities using Accumedic should request the vendor's incident report and forensic findings, verify whether their patient records were in scope, and meet HIPAA Breach Notification Rule timelines; affected individuals should monitor for identity theft and medical identity fraud.