Excelas

Summary

Excelas experienced an unauthorized intrusion into its systems that allowed access to a range of personal and medical data. The intrusion was identified after suspicious activity was observed, prompting the company to notify affected individuals and file a breach notice with a state regulator. A law firm is now investigating potential claims on behalf of those whose information may have been compromised.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On November 27, 2025, an unauthorized actor gained access to certain systems operated by Excelas, and the intrusion continued until December 3, 2025. Excelas did not become aware of the breach until January 28, 2026, when suspicious network activity was detected. Upon detection, the company engaged third‑party cybersecurity experts to conduct a forensic investigation of the compromised environment. The investigation aimed to determine the scope of the unauthorized access and the specific data elements that may have been viewed or acquired.

Excelas subsequently determined that the potentially exposed information included names, dates of birth, Social Security numbers, government‑issued identification numbers, medical and health details such as diagnoses, medication information, medical record images, insurance data, and payment information. On May 12, 2026, the company filed a notice of the incident with the Commonwealth of Massachusetts and began sending notifications to individuals whose data might have been affected. The notifications informed recipients that their personal and protected health information could have been involved in the breach.

In response to the notifications, the national class action law firm Edelson Lechtzin LLP announced that it is investigating potential privacy claims arising from the Excelas data breach and is offering free consultations to those who received a notice. Excelas describes itself as a provider of medical record organization and document management services for healthcare providers, insurers, and law firms. Edelson Lechtzin LLP notes that it handles a range of class action matters, including data breach litigation, securities and investment fraud, antitrust violations, ERISA benefit plans, wage theft, and consumer fraud.

Sources

Sources available to members: 1 source.