Episource, LLC Data Breach — Official Case File

From the AG filing description

Episource, LLC operates as a specialized healthcare services and technology company that partners with health plans, medical groups, and healthcare providers to manage risk adjustment, medical record review, and clinical data analytics. Because of the critical nature of its operations, Episource routinely ingests, processes, and stores vast quantities of electronic protected health information (ePHI) and personally identifiable information (PII) on behalf of major healthcare organizations. This data pipeline includes intricate medical histories, diagnostic codes, insurance details, and demographic information for millions of patients nationwide. The sheer volume and high sensitivity of the medical and personal records entrusted to Episource make it an immense repository of valuable data, rendering it an attractive target for malicious cybercriminals seeking to exploit vulnerabilities in the healthcare technology sector. In 2025, Episource, LLC reported a significant data security incident to the New Hampshire Attorney General, alerting regulators and affected individuals to an unauthorized compromise of its network infrastructure. While exact technical findings often emerge gradually during forensic investigations, breaches affecting healthcare data processing vendors typically involve sophisticated cyberattacks such as unauthorized access to internal databases, ransomware deployment, or vulnerabilities within third-party software supply chains. In the context of healthcare data analytics and chart-review platforms, attackers frequently target centralized repositories where vast arrays of aggregated medical and demographic records are stored, bypassing perimeter defenses to infiltrate systems housing unencrypted or insufficiently protected files. The data compromised in the Episource breach likely encompasses a devastating combination of sensitive personal, financial, and protected health information. Victims face exposure of full names, dates of birth, Social Security numbers, health insurance identification details, and comprehensive medical record information, including diagnoses, treatment codes, and clinical histories. The exposure of this specific data matrix creates severe, long-term risks for affected individuals. Unlike easily replaceable credit card numbers, compromised Social Security numbers and detailed medical histories can be weaponized by bad actors to commit medical identity theft—where fraudsters obtain unauthorized care using a victim's insurance—file fraudulent tax returns, and execute complex financial scams that may plague victims for years. As an entity handling sensitive health information and administrative data for healthcare providers, Episource, LLC is bound by stringent legal and regulatory frameworks, including the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, and state-level consumer protection statutes. Under HIPAA and related privacy regulations, companies handling ePHI are mandated to implement robust administrative, physical, and technical safeguards, such as end-to-end encryption, multi-factor authentication, regular vulnerability patching, and continuous network monitoring. The occurrence of a widespread data breach strongly suggests potential failures in maintaining these mandatory security controls, raising serious questions regarding whether the company met its legal duties of care. Receiving a data breach notification letter from Episource, LLC is a formal admission that your private, sensitive information was compromised due to inadequate data security practices. Under established legal principles, the receipt of such a notification provides affected consumers with the legal standing necessary to initiate and participate in class action litigation. Crucially, you do not need to prove that you have already suffered actual financial loss or identity theft to join a class action lawsuit; the increased risk of future harm and the loss of privacy resulting from the breach are sufficient. Our firm investigates these incidents on a contingency fee basis, meaning there are never any out-of-pocket costs or upfront legal fees, and we only collect compensation if we successfully recover damages on your behalf.