A data breach at Ridgeway Pharmacy in Montana has affected almost 259,000 individuals. Data breaches have also been announced by IMS Care Center in Arizona and Persona Dental in Minnesota. Ridgeway Pharmacy Ridgeway Pharmacy Ltd, a Victor, Montana-based mail order and community pharmacy, has identified a data security incident involving its website that exposed the personal and protected health information of 258,920 of its customers.
Ridgeway Pharmacy said that on August 21, 2026, it became aware that personal information had been exposed via its third-party designed and developed website. An investigation was launched to determine the extent of the unauthorized access, with assistance provided by third-party digital forensics experts. They confirmed that the incident was limited to its website, and no internal systems were involved.
Data potentially compromised in the incident included names, addresses, dates of birth, prescription information, health information, and insurance information. A subset of individuals also had payment card information exposed. In response to the incident, Ridgeway Pharmacy has reviewed its third-party website maintenance and data security arrangements and has implemented additional security protections to prevent similar incidents in the future.
They include switching to a new website platform, restricting access, and strengthening monitoring. As a precaution against data misuse, the affected individuals have been offered complimentary credit monitoring and identity theft protection services. Get The FREE HIPAA Compliance Checklist Immediate Delivery of Checklist Link To Your Email Address Please enable JavaScript in your browser to complete this form.
Business Email * Name * First Last Number * Company Name * Get Free Checklist Please Enter Correct Email Address Your Privacy Respected HIPAA Journal Privacy Policy IMS Care Center IMS Care Center, a Phoenix, Arizona-based physician-owned multi-specialty medical practice, has identified unauthorized access to its email environment. Suspicious activity was identified on June 18, 2026.
Its email system was secured, and an investigation was launched to determine the nature and scope of the unauthorized activity. The investigation confirmed that an unauthorized third party accessed its email system between June 17, 2026, and June 18, 2026. The affected email accounts were reviewed, and on September 30, 2026, IMS Care Center confirmed that patient names, addresses, Social Security numbers, and medical information had been exposed.
Notification letters were mailed to the affected individuals on October 16, 2026, and at least 12 months of complimentary credit monitoring and identity theft protection services have been offered to the affected individuals. IMS Care Center said several steps have been taken to improve email security, including implementing new technical safeguards, Sophos MDR, geographical restrictions on email access, enhanced phishing training for the workforce, updated data privacy and security policies and procedures, and it has committed to periodic technical and nontechnical evaluations.
The incident has been reported to state attorneys general and the HHS’ Office for Civil Rights; however, it has yet to be added to the OCR breach portal, so it is unclear how many individuals have been affected. Persona Dental Persona Dental, a Sartell, Minnesota-based family and cosmetic dental practice, has announced a data security incident that has affected 3,386 current and former patients.
Suspicious activity was identified within its computer network on or around April 30, 2026. The forensic investigation determined that its network had been accessed by an unauthorized third party between April 28, 2026, and April 30, 2026. Its network was secured, and additional security measures have been implemented to prevent similar incidents in the future.
The review of the affected files has recently been completed, and it has been confirmed that patient data such as names, dates of birth, diagnosis and treatment information, and health insurance information were involved. For certain patients, Social Security numbers were involved. Notification letters started to be mailed to the affected individuals on September 9, 2026, and individuals who had their Social Security numbers exposed have been offered complimentary credit monitoring services.
The post Ridgeway Pharmacy Data Breach Affects 259,000 Individuals appeared first on The HIPAA Journal .
Originally published at hipaajournal.com
