Silver Summit Medical Corporation Data Breach Investigation
Silver Summit Medical Corporation, doing business as Digestive Disease Center and Heart Vascular & Leg Center, reported a third-party cybersecurity event involving certain patients’ personal and protected health information. The notice states that data may have been acquired without authorization from a vendor’s systems. Strauss Borrelli PLLC is investigating the reported Silver Summit Medical Corporation data incident and its impact on affected individuals. If you received a notice, you may fill out the secure contact form on this page to ask whether you may qualify to pursue a claim.
Key Facts at a Glance
- Entity Involved: Silver Summit Medical Corporation dba Digestive Disease Center and Heart Vascular & Leg Center (Healthcare)
- Incident Type: Third-party vendor cybersecurity event involving reported unauthorized data acquisition
- Date of Incident: November 27, 2025 to November 30, 2025
- Discovery Date: July 20, 2026
- Official Notice Date: August 19, 2026 (reported public notice and listing date)
- Exposed Information: Names, Social Security numbers, dates of birth, driver’s license information, financial account or payment card information, medical information, health insurance information, taxpayer identification numbers, and passport or other government identification numbers
- Affected Population: Under investigation; no total was stated in the available notice
What Happened?
According to SSMC’s public notice, the organization became aware on or about July 20, 2026, that a cybersecurity event involving an unnamed third-party vendor affected personal and protected health information received by SSMC. The notice reports that certain information on the vendor’s systems was acquired without authorization from November 27 through November 30, 2025. This description indicates a vendor-related incident rather than a confirmed intrusion into every SSMC system.
SSMC said it began investigating and responding after learning of the event and moved to notify potentially affected individuals. It also reported reviewing existing information-security policies and procedures. The available notice does not identify the vendor, explain the technical method used, or state a total number of affected people. Accordingly, the scope should be understood as reported and limited to the details publicly disclosed. Individuals who received treatment at Digestive Disease Center or Heart Vascular & Leg Center may have been affected, but receipt of care alone does not establish that a particular person’s information was involved.
What Information Was Exposed?
The public notice states that the affected vendor data included certain individuals’ names and one or more sensitive identifiers. Reported categories include Social Security numbers, dates of birth, driver’s license numbers, financial account or payment card information, taxpayer identification numbers, and passport or other government identification numbers. Medical treatment information, prescription information, diagnoses, and health insurance policy numbers also may have been involved.
The notice does not indicate that every listed category applied to every person. Because the reported information combines identity, financial, and healthcare data, affected individuals may face risks such as medical identity theft, fraudulent patient billing, false insurance claims, prescription-related inquiries, account fraud, or convincing healthcare impersonation scams.
What Should You Do Next?
- Review your notice and available protection services: Confirm which information the organization says was involved for you. SSMC reported offering complimentary credit monitoring and identity restoration services through Cyberscout; follow the enrollment instructions and deadlines in your individual notice.
- Check your credit reports and consider a security freeze: Review reports from Equifax, Experian, and TransUnion for unfamiliar accounts or inquiries. A free credit freeze can make it more difficult for someone to open new credit using your identity.
- Monitor financial and payment accounts: Watch for unauthorized charges, transfers, account-verification messages, or password-reset attempts. Contact the relevant financial institution promptly about suspicious activity rather than using links or phone numbers in unsolicited messages.
- Review medical and insurance records: Examine explanation-of-benefits statements, patient portal entries, prescription records, and bills for services you did not receive. Report discrepancies to the healthcare provider and insurer because they may indicate medical identity theft or fraudulent billing.
- Be alert for healthcare phishing: Treat unexpected calls, emails, or texts about insurance verification, prescriptions, billing refunds, or patient records with caution. Verify requests through a known provider or insurer contact before sharing personal information or making a payment.
Your Legal Rights
People whose information was involved in a cybersecurity incident may have rights under state privacy, consumer-protection, contract, or other applicable laws. Available options depend on factors such as where the person lives, what information was affected, the notices provided, and whether the incident caused losses or other harm. Potentially affected individuals should preserve the notice letter, credit-monitoring enrollment materials, suspicious communications, account statements, medical bills, insurance records, and receipts for expenses related to protecting their identity.
The existence of a notice does not automatically establish liability or guarantee compensation. A legal review may help determine whether an individual could be included in an investigation or potential claim. General information about this event is not a substitute for legal advice concerning a particular situation.
Why Hire Strauss Borrelli PLLC?
The firm represents consumers in privacy and cybersecurity matters and evaluates reported incidents involving sensitive personal, financial, and health information. Its attorneys can review the available notice, assess how applicable law may relate to an individual’s circumstances, and explain possible next steps. Consultations are confidential, and contacting the firm does not guarantee that a claim will be available or successful.
If you received a breach notification letter from Silver Summit Medical Corporation d/b/a Digestive Disease Center and Heart Vascular & Leg Center:
We would like to speak with you about your rights and potential legal remedies in response to this data breach. Please fill out the form, below, or contact us at 872.263.1100 or sam@straussborrelli.com.
