Unlimited Technology Systems, a practice management and revenue cycle software vendor, has disclosed a data breach affecting at least 442,000 patients whose personal and medical information was exposed in an October 2025 hack.
A subsequent forensic investigation found an unauthorized actor accessed files and obtained personal information between Oct. 5 and Oct. 10, 2025, according to a notice filed with the Iowa Attorney General’s office. Exposed data varied by individual and may have included health insurance and patient balance information, medical record numbers, dates of service, diagnosis details, Social Security numbers, scanned identification documents and insurance cards.
The company said the breach did not involve full patient medical records, medical imaging or financial account information such as credit card or bank account numbers. Unlimited Technology Systems began notifying affected individuals July 21, 2026 and is offering 24 months of free identity monitoring.
Iowa’s notice alone covers roughly 162,000 residents, while South Carolina’s filing lists about 148,000. Residents of California, Massachusetts, Texas and Vermont are also among those affected.
As a third-party software vendor serving specialty healthcare practices nationwide, Unlimited Technology Systems’ breach illustrates how a single vendor incident can ripple across patients of dozens of unrelated provider organizations.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.