Premier Medical Group Data Breach

Premier Medical Group of the Hudson Valley, a multispecialty practice, has notified more than 280,000 patients that hackers accessed treatment and diagnostic records. The practice’s own notice doesn’t say when it discovered the intrusion — only when the review finished.

Premier Medical Group of the Hudson Valley, P.C., a multispecialty medical practice serving patients across cardiology, dermatology, gastroenterology, neurology, plastic surgery, gynecology, and internal medicine, reported a data breach to the U.S. Department of Health and Human Services Office for Civil Rights on August 21, 2026, affecting 282,075 individuals. According to the practice’s own notice, attackers accessed files containing patient information on June 14, 2026, and the practice completed its review of the affected data on July 14, 2026 — with notice to HHS following five weeks after that, and notice to patients around the same time.

Source: U.S. Department of Health and Human Services Office for Civil Rights breach portal, submission dated 08/21/2026 (282,075 individuals); SecurityWeek, ‘280,000 Impacted by Premier Medical Group Data Breach,’ 09/16/2026.

What Information Was Exposed?

According to Premier Medical Group’s own notice, the exposed information includes:

• Full name
• Contact information
• Date of birth
• Treatment and diagnostic details
• Medication information
• Health insurance information
• Dates of service
• Provider names
• Internal patient identification numbers

Notably, no source reviewed for this post itemizes a Social Security number or financial account element as exposed. This isn’t a typical identity-theft-driven breach — it’s a breach of clinical and treatment records at a practice that spans several sensitive specialties, including gynecology.

A Missing Detection Date

Premier Medical Group’s notice states when the review of affected data was completed — July 14, 2026 — but does not state when the practice actually detected the intrusion. That’s a meaningful gap. Without a detection date, there’s no way to measure how quickly the practice responded once it became aware something was wrong, and the sixty-day notification clock that applies to HIPAA covered entities under 45 C.F.R. Section 164.408 can’t be tested against the public record. What is measurable is this: 68 days passed between the June 14 access date and the August 21 HHS submission.

No Group Has Claimed Responsibility

As of this writing, no ransomware or extortion group has publicly claimed responsibility for this attack, and Premier Medical Group has not described how the intrusion occurred. This is unusual compared to many recent healthcare breaches, where an attacker group typically posts a claim on a leak site within days.

Why This Practice’s Records Matter

Premier Medical Group’s specialties include gynecology, plastic surgery, and gastroenterology — areas of care where patients have a strong, reasonable expectation of privacy. The exposed record set includes actual treatment and diagnostic details and medication information, not just contact information. For patients, that means the breach potentially reveals specific medical conditions and the care they received for them.

Do You Have Legal Options?

Healthcare providers that collect and store sensitive treatment and diagnostic information have a legal duty to secure it and to notify patients without unreasonable delay.

If you’re a current or former patient of Premier Medical Group of the Hudson Valley, contact Emery | Reddy today for a Free Case Review.

Much of the information involved in this incident may also qualify as Protected Health Information (PHI). PHI includes medical or healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.

FAQ

Who is affected by the Premier Medical Group data breach?

Premier Medical Group reported 282,075 affected individuals to HHS on August 21, 2026 — patients across its cardiology, dermatology, gastroenterology, neurology, plastic surgery, gynecology, and internal medicine practices.

What information was exposed?

According to the practice’s own notice, the exposed data includes names, contact information, dates of birth, treatment and diagnostic details, medication information, health insurance information, dates of service, provider names, and internal patient ID numbers. No Social Security number or financial account information has been identified as exposed.

When did the breach happen, and when was I notified?

Attackers accessed patient files on June 14, 2026. Premier Medical Group completed its review of the affected data on July 14, 2026, and reported the breach to federal regulators on August 21, 2026. The practice has not disclosed when it first detected the intrusion.

Has a hacking group claimed responsibility?

No. As of this writing, no ransomware or extortion group has publicly claimed responsibility, and the practice has not described how the breach occurred.

Do I have a legal claim?

Healthcare providers that collect and store sensitive treatment and diagnostic information have a legal duty to secure it and to notify patients without unreasonable delay. If you’re a current or former patient of Premier Medical Group of the Hudson Valley, contact the Data Breach Attorneys at Emery | Reddy at 916.995.5968 or www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.