XYZ Corp

Profile narrative

XYZ Corp operates as a healthcare technology services provider.
The organisation delivers patient portal solutions that allow healthcare clients to manage and share patient information.
Its services are focused on the healthcare sector, supporting digital access to medical records.

The publicly available sources do not specify the organisation's employee count, annual revenue, or geographic footprint.
No explicit market share or client base size is disclosed in the incident reports.
Consequently, any description of XYZ Corp's scale must be based solely on the information provided in the breach notification.

XYZ Corp's core competency lies in handling protected health information through its patient portal platform.
The breach exposed a range of sensitive data elements, including names, addresses, Social Security numbers, dates of birth, medical diagnoses, treatment details, Medicaid IDs, and portal usernames.
This indicates that the organisation's systems are designed to store and transmit personally identifiable and health‑related data subject to privacy regulations.

No details about XYZ Corp's ownership structure, parent company, or subsidiary relationships are mentioned in the available material.
Likewise, there is no public information regarding whether the entity is privately held, publicly traded, or part of a larger conglomerate.
Therefore, the organisational hierarchy remains unspecified in the source context.

On August 26, 2021, XYZ Corp experienced a security breach when an attacker compromised its patient portal.
The intrusion resulted in the exfiltration of files containing sensitive patient information affecting over 319,000 individuals initially.
The compromised data encompassed personal identifiers, demographic details, and clinical information as outlined in the breach notice.

Subsequent to the initial discovery, ransomware actors claimed responsibility for the attack.
An additional entity reported exposure of approximately 6,000 patient records linked to the same incident.
The organisation stated that the attack was contained to specific systems and did not affect other client infrastructures.
Details of the breach were reported by Databreaches.net, providing a public source for the timeline and scope of the event.

Incidents

1 incident linked to this organisation.