Heart South Cardiovascular Group

Summary

Heart South Cardiovascular Group became aware that an unauthorized party claimed to possess its data, and later determined that a malicious actor had uploaded the information to the dark web. The exposed data may include names, emails, phone numbers, birth dates, and Social Security numbers. Edelson Lechtzin LLP is investigating the incident and pursuing potential class action claims on behalf of affected individuals.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Heart South Cardiovascular Group, which provides advanced minimally invasive heart and vascular care in Central Alabama, became aware on November 11, 2025, that an unauthorized party claimed to possess some of its data. According to a filing with the Maine Attorney General, the organization learned on or about that date of the alleged unauthorized access. After conducting an investigation, Heart South determined that a malicious actor had recently uploaded its data to the dark web, and that the exposed information may include names, email addresses, phone numbers, birth dates, and Social Security numbers. The entity subsequently issued data breach notifications to individuals whose information was potentially affected.

The possible exposure of personal identifiers raises the risk of identity theft and fraud for those whose data was compromised. In response to the incident, Edelson Lechtzin LLP, a national class action law firm, began investigating data privacy claims arising from the breach. The firm is pursuing a class action aimed at obtaining legal remedies for individuals whose sensitive personal information may have been disclosed in the Heart South incident.

Heart South's internal investigation included determining how the data was transferred to the dark web and assessing the scope of the unauthorized acquisition. Edelson Lechtzin LLP's investigation involves reviewing the breach details, evaluating the potential legal claims of affected persons, and gathering information to support the class action. The ongoing legal inquiry seeks to address the consequences of the data exposure for the individuals involved.

Sources

Sources available to members: 2 sources.