BASS Medical Group Waited 48 Days to Announce a Data Breach Involving Health Insurance and Medical Billing Information: What Patients Need to Know

A Bay Area medical group found hackers in its network on September 4, 2026. Patients did not hear about it until October 22.

How the BASS Medical Group Breach Happened

BASS Medical Group is a physician-led specialty care provider based in Walnut Creek, California. The group describes itself as having more than 200 locations, mostly around the San Francisco Bay Area.

On or around September 4, 2026, BASS found suspicious activity in its computer network. The group says it secured the network and hired outside cybersecurity experts to investigate. On or about September 22, 2026, that investigation found that some personal and/or protected health information may have been accessed or taken without permission.

BASS posted a notice about the incident on its website on October 22, 2026. It also filed a sample notice with the California Attorney General. BASS says it has notified the California Attorney General, the FBI and the U.S. Department of Health and Human Services Office for Civil Rights (the federal office that enforces health privacy law).

BASS states that it has “no evidence to suggest misuse or attempted misuse of this information.” BASS has not said who was behind the intrusion or whether files were actually copied out of its network.

A 48-Day Gap Between Discovery and Notice

The timeline matters for patients. Here is how it unfolded, based on BASS’s own notice:

• September 4, 2026: BASS discovers suspicious activity in its network.
• September 22, 2026: The investigation finds patient information may have been accessed or acquired.
• October 22, 2026: BASS posts its public notice and files with the California Attorney General.

That is 48 days from discovery to public notice, and 30 days after BASS knew patient information may have been involved. During that window, affected patients had no warning to watch their insurance statements or medical bills. BASS has not explained why notice took this long.

BASS has not disclosed how many people were affected. Its website notice and its California filing do not give a total, and no other state filing has been located so far.

Why Medical Billing Codes and Insurance Details Are Valuable to Criminals

This breach did not involve a list of credit card numbers. It involved something that can be harder to fix. Medical treatment and billing codes are the codes doctors use to describe a diagnosis or procedure on a bill. Those codes can reveal sensitive health details, such as a condition a patient is being treated for.

Health insurance information, such as a member ID or policy number, can be used for medical identity theft. That is when someone uses another person’s insurance to get care, prescriptions or equipment, or to file false claims. Victims may find unfamiliar treatment on their records, denied claims, or bills for care they never received. Unlike a credit card, an insurance member ID is not always quick to replace.

What Information Was Exposed?

According to the BASS notice, the information involved may include:

• Medical treatment codes or billing information
• Health insurance information

BASS says not all of this information was involved for every person. The notice does not list Social Security numbers, financial account numbers or driver’s license numbers.

What Is BASS Medical Group Offering Affected Patients?

BASS’s notice does not offer  free credit monitoring or identity protection services. Instead, the notice points patients to free tools such as fraud alerts, security freezes and annual credit reports. Patients who receive a letter should check it for any offer that may not appear in the public notice.

BASS has set up a toll-free call center for questions at 1-855-711-7083, Monday through Friday, 5:00 a.m. to 5:00 p.m. Pacific Time, excluding major U.S. holidays.

Your Health Information Is at Risk

Medical and insurance data carries risks that last. A person can cancel a credit card in minutes, but errors in a medical record or insurance history can take months to correct. Criminals may also use details from a breach to make scam calls, texts or emails look real.

Affected individuals can take these steps:

• Review every Explanation of Benefits (EOB) statement from your health insurer for care you did not receive.
• Request a list of claims paid under your name from your insurer.
• Report any unfamiliar charges to your insurer and to BASS right away.
• Be wary of calls, texts or emails that mention the BASS incident and ask for personal or payment details.
• Consider a free fraud alert or security freeze with Equifax, Experian and TransUnion.
• Check your free credit reports at annualcreditreport.com.

Do You Have Legal Options?

Medical providers that collect patient health and insurance information have a legal duty to protect it. They also have a duty to tell patients promptly when that information may have been exposed. When those duties are not met, affected patients may have legal rights and remedies.

Emery | Reddy is investigating the BASS Medical Group data breach on behalf of affected patients. A free case review can help you see what you may qualify for. No Fee Unless We Recover.

Contact Emery | Reddy today at 206.207.8929 or visit www.emeryreddy.com for a Free Case Review.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Much of the information involved in this incident may also qualify as Protected Health Information (PHI). PHI includes medical or healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.

Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.

Frequently Asked Questions About the BASS Medical Group Data Breach

How many people were affected by the BASS Medical Group data breach?

BASS has not said. Its website notice and its filing with the California Attorney General do not give a total. California law requires a sample notice to be filed with the Attorney General when a breach affects more than 500 California residents, so the filing suggests the incident reached at least that threshold. The full number may be higher.

What information was exposed?

According to BASS, the information may include:

• Medical treatment codes or billing information
• Health insurance information

Did BASS say whether my Social Security number was involved?

The public notice does not list Social Security numbers. Read your own letter closely, since it should describe the information involved for you.

Why did it take BASS so long to notify patients?

BASS found suspicious activity on September 4, 2026, and learned patient information may have been involved on September 22. It posted public notice on October 22, 2026. That is 48 days after discovery. BASS has not explained the delay.

Is BASS offering free credit monitoring?

The public notice does not offer credit monitoring or identity protection. Check your letter in case an offer was included, or call the BASS call center at 1-855-711-7083.

What harm can come from a medical data breach?

Medical data can be misused in ways that are hard to spot and slow to fix. Possible harms include:

• Someone using your insurance to get care or prescriptions
• False claims that use up your benefits or show up on your record
• Wrong information added to your medical history
• Targeted scams that use your health details to seem believable

How do I protect myself from scams that mention the breach?

Scammers often reach out after a breach is in the news. To stay safe:

• Do not give personal or payment details to anyone who contacts you first
• Call BASS back using the number in your letter or on its official website
• Do not click links in unexpected texts or emails about the breach
• Report suspicious contacts to the FTC at reportfraud.ftc.gov

What should I do if I received a notification letter?

Keep the letter in a safe place. Then:

• Review your insurance EOB statements and medical bills
• Consider a free fraud alert or credit freeze
• Watch for scam calls and messages
• Contact Emery | Reddy for a Free Case Review

Do I have a legal claim?

You may. Medical providers have a duty to protect patient information and to give timely notice when it may have been exposed. If BASS fell short of those duties, you may be entitled to compensation. Contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.