Casper Orthopedic Associates

Summary

Casper Orthopedic Associates reported a cybersecurity incident after discovering an attack, engaged external experts to contain and investigate, and later concluded that patient data may have been accessed; a subsequent data review identified exposed information including names, birth dates, driver’s license numbers, Social Security numbers, financial details, and medical records, leading to notification of tens of thousands of individuals. Atlantic Digestive Specialists detected suspicious network activity, enlisted cybersecurity specialists who confirmed unauthorized access to its systems, completed a data review that revealed a broad set of personal and health information potentially compromised, and began mailing notices to affected individuals.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Casper Orthopedic Associates, an orthopedic medical practice located in Casper, Wyoming, identified that it had fallen victim to a cyberattack on May 23 2026. Upon discovery, the organization promptly engaged third‑party cybersecurity experts to assist with containing the threat, remediating affected systems, and conducting a thorough investigation. The experts worked alongside internal IT staff to isolate compromised networks and preserve evidence for forensic analysis. This initial response aimed to limit further unauthorized access and to begin understanding the scope of the breach.

The investigation conducted by the third‑party team concluded on June 11 2026, at which point investigators determined that patient data may have been acquired by an unauthorized third party during the incident. Following the conclusion of the investigative phase, a comprehensive data review was undertaken and finalized on September 2 2026. Once the review was complete, notification letters were prepared and mailed to the affected individuals on September 8 2026, informing them of the potential exposure of their information. The breach ultimately impacted 56,197 individuals whose records were held by the practice.

The data that may have been accessed included a combination of personal identifiers such as names, dates of birth, driver’s license numbers, and Social Security numbers, as well as financial account information and various medical details. No additional specifics about the attacker’s identity, methods, or the exact systems compromised were disclosed in the available source material. The notification process marked the completion of the organization’s mandated response steps under applicable breach reporting requirements.

Sources

Sources available to members: 1 source.