Chicago-based orthopaedic practice Illinois Bone & Joint Institute said it experienced a data security incident that compromised the sensitive personal information of its patients and staff.

In a data breach notice filed with the Attorney General of Massachusetts, Illinois Bone & Joint Institute said that on July 4, it detected suspicious activities within its internal network. The healthcare provider immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 “The investigation determined that an unauthorised third party accessed the IBJI network between May 30, 2024, and July 4, 2024, and acquired certain files during this period,” reads the notice.

The compromised data included names, addresses, dates of birth, Social Security numbers, medical treatment and diagnosis information, and health insurance or claims information.

While IBJI’s filing with the Massachusetts state regulator does not state the number of affected individuals, the orthopaedic practice says it has started notifying the affected individuals.

“We are taking steps to reduce the risk of this type of incident occurring in the future, including enhancing our technical security measures,” the healthcare institute added.

While IBJI found no evidence of the compromised information being misused, it advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and state attorney general.

It has also offered two years of complimentary identity protection and credit monitoring services through Experian IdentityWorks to all affected individuals.

At the time of writing, no hacker group has claimed responsibility for the data security incident on IBJI. The orthopaedic practice also did not say who is behind the cyber attack or how the threat actors infiltrated its internal network.