Caduceus Medical Group Data Breach

Caduceus Medical Group, Inc. says someone accessed and took information from its network on August 13, 2026. That information may include diagnoses, medical record numbers, and Medicare or Medicaid details.

What Happened at Caduceus Medical Group

Caduceus Medical Group, Inc. (CMG) is a medical group with offices in Yorba Linda, Irvine, and Laguna Beach, California. CMG posted a notice on its website titled “Caduceus Medical Group, Inc. Provides Notice of a Cyber Event.”

According to the notice, CMG began investigating a potential cyber event on August 13, 2026. CMG worked with outside forensic investigators. (Forensic investigators are experts who trace how a computer system was accessed.) The investigation found that certain information within CMG’s network was “accessed and taken on August 13, 2026.” CMG says the event did not affect patient care or services.

CMG says it is reviewing its security policies and reporting the event to government agencies and law enforcement.

A Ransomware Group Claimed the Attack Two Weeks Later

CMG’s notice does not name an attacker. It does not use the word ransomware. (Ransomware is malicious software that criminals use to lock or steal files and then demand payment.) However, on August 28, 2026, a ransomware group called Anubis listed Caduceus Medical Group on its dark web leak site. A leak site is a website where criminal groups post the names of victims and threaten to publish stolen files.

According to ThreatCluster, a threat-intelligence site that captured the listing, the group claimed to hold about 105 GB of patient, employee, and financial data. ThreatCluster also noted that a leak-site listing “is not confirmation that a breach occurred.” SOCRadar, another security research site, labels the claim as alleged and unverified.

CMG has not publicly linked its cyber event to Anubis. The group’s claims have not been confirmed.

What Caduceus Medical Group Has Not Said Yet

CMG’s web notice does not show a posting date. The page’s site data shows a last update on October 13, 2026, about two months after the August 13 data theft. CMG has not said when it first notified patients. The notice lists no phone number for questions. It directs readers to an email link.

CMG has not disclosed the total number of people affected. As of this writing, no state attorney general filing or federal breach report for this incident has been located.

Sources: Caduceus Medical Group, “Cybersecurity” notice (https://www.caduceusmedicalgroup.com/cybersecurity/); SOCRadar (https://socradar.io/data-breach/caduceus-medical-group-anubis-2026/).

What Information Was Exposed?

According to CMG’s notice, the information involved may have included a combination of the following:

• Name
• Date of birth
• Health insurance information
• Medical information, including billing or claims information
• Diagnosis
• Physician information
• Medical record number
• Medicare/Medicaid information
• Prescription/medication information
• Diagnostic and treatment information

CMG notes that not every person’s records include every item on this list. The notice does not list Social Security numbers or bank account numbers.

What Is Caduceus Medical Group Offering Affected Patients?

CMG’s notice does not offer free credit monitoring or identity protection. It names no vendor, coverage length, or enrollment deadline. It only describes general steps, such as free credit reports, fraud alerts, and credit freezes. Letters sent to patients may include more details.

Your Medical Information Is at Risk

A stolen credit card can be canceled. A diagnosis cannot. Criminals can use names, birth dates, and insurance or Medicare details to bill for care that never happened. This is called medical identity theft. It can leave false entries in medical records and lead to surprise bills.

Affected individuals should:

• Review every explanation of benefits (EOB) statement from insurers and Medicare.
• Report any service or prescription that was never received.
• Get free credit reports at www.annualcreditreport.com.
• Consider a free fraud alert or credit freeze with Equifax, Experian, and TransUnion.
• Treat calls, texts, or emails that mention the breach with caution.

Do You Have Legal Options?

Medical groups that collect patient health information have a legal duty to protect it. When that duty is not met, affected patients may have legal rights and remedies. A Free Case Review can help determine whether those rights apply.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. 

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Much of the information involved in this incident may also qualify as Protected Health Information (PHI). PHI includes medical or healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.

Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.

FAQ

How many people were affected by the Caduceus Medical Group data breach?

Caduceus Medical Group has not said. Its notice gives no count, and no state or federal filing with a number has been found yet.

What information was taken?

According to the notice, it may include your name, date of birth, insurance and Medicare/Medicaid details, diagnosis, medical record number, and prescription and treatment information. Not every record includes every item.

Was this a ransomware attack?

Caduceus Medical Group has not said. A ransomware group called Anubis claimed the attack on its leak site on August 28, 2026. That claim has not been confirmed by the medical group.

When did Caduceus Medical Group tell patients?

The data was taken on August 13, 2026. The website notice has no posting date, but it was last updated on October 13, 2026. Caduceus Medical Group has not said when letters went out.

What should I do if I received a notice?

• Read every EOB and Medicare statement closely.
• Report care or prescriptions you never received.
• Ask for a copy of your medical records.
• Consider a fraud alert or credit freeze.
• Request a Free Case Review.

Could scammers contact me about this breach?

Yes. Criminals sometimes call or email people and mention a real breach by name to seem trustworthy. Do not share personal or payment details with anyone who contacts you first. Call your provider or insurer using a number you already know.

Do I have a legal claim?

You may. Healthcare providers have a duty to protect patient information and to tell patients when it is compromised. If Caduceus Medical Group did not meet those duties, you may have legal rights. Contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.