ModMed Data Breach Investigation

Recently, ModMed reported to the Attorney General of Vermont that it had experienced a data breach in which sensitive personal identifiable information and protected health information in its care may have been compromised. According to the breach notice, on July 21, 2025, ModMed became aware of potential unauthorized activity in certain computer servers.¹ As a result, ModMed launched an investigation to determine the nature of the incident.

Through its investigation, ModMed confirmed that sensitive personal information in its systems belonging to its podiatry customers may have been accessed and acquired by an unauthorized third party between July 9 and July 10, 2025. As a result, ModMed began a review of the data to determine what information had been impacted as well as identify the specific individuals affected. While the information impacted varies depending on the individual, the type of information potentially exposed includes:

• Name
• Address
• Date of birth
• Phone number
• Email address
• Health insurance information
• Medical information (medical record number, patient account number, dates of service, provider and practice name, billing/diagnostic codes, prescription/medication information, and/or diagnosis and treatment information)

On October 17, 2025, ModMed began mailing data breach notification letters to impacted individuals. Based on the breach notice sent to Vermont residents, ModMed is providing affected individuals with a list of the specific types of sensitive information impacted and complimentary credit monitoring services. A link to the breach notification letters that ModMed filed with the Attorney General of Vermont is below.