ApolloMD Healthcare Data Breach Exposes Sensitive Patient Information

In May 2025, ApolloMD, a physician and practice management services provider based in Atlanta, Georgia, suffered a major cybersecurity incident that compromised the personal data of more than 626,000 individuals. The breach highlights the growing risks facing the healthcare sector, where sensitive patient information is a prime target for cybercriminals.

What Happened?

Between May 22 and May 23, 2025, hackers gained unauthorized access to ApolloMD’s systems. According to the company’s official notice, the attackers stole files containing both personally identifiable information (PII) and protected health information (PHI).

The exposed data included:

• Names, addresses, and dates of birth
• Diagnostic details and treatment information
• Provider names and dates of service
• Health insurance information
• In some cases, Social Security numbers

Who Is Impacted?

The U.S. Department of Health and Human Services (HHS) later confirmed that 626,540 individuals were affected. ApolloMD began notifying affiliated physicians and practices by September 2025 and mailed letters to impacted individuals, offering free credit monitoring services.

Connection to Ransomware

While ApolloMD has not disclosed the identity of the attackers, the Qilin ransomware group added the company to its leak site in early June 2025. This suggests that the breach may have involved both data theft and extortion attempts, a common tactic in healthcare ransomware attacks.

About ApolloMD

ApolloMD provides integrated, multispecialty physician and practice management services to over 125 practices across 18 states, working with more than 2,500 physicians and advanced practice clinicians (APCs). Its scale makes it a significant target for cybercriminals seeking large volumes of sensitive healthcare data.

Why This Matters

Healthcare data breaches are particularly damaging because:

• Medical identity theft can be used to fraudulently obtain care or prescriptions.
• Financial fraud may occur through stolen insurance details.
• Unlike passwords, medical records cannot be “reset” once exposed.

This incident underscores the urgent need for robust cybersecurity measures in healthcare organizations, including stronger data encryption, employee training, and proactive monitoring against ransomware threats.