A ransomware group has claimed responsibility for a cyberattack targeting Internal Medicine and Pediatrics of Cullman, P.C. (IMPC), a healthcare provider serving patients in Cullman, Alabama.
According to a recently filed lawsuit, the attackers allegedly stole sensitive patient information and published data connected to the breach on the dark web. As of the lawsuit's filing date, affected patients reportedly had not received individual notification letters.
If you were a current or former adult patient of IMPC, your personal and medical information may have been exposed without your knowledge.
What Happened in the IMPC Data Breach?
According to the class action lawsuit Spears v. Internal Medicine and Pediatrics of Cullman, P.C., cybercriminals allegedly gained unauthorized access to IMPC's systems on or around May 21, 2026. The complaint states that a ransomware group known as "Payload" claimed responsibility for the attack and allegedly published information connected to IMPC on a dark web leak site. The lawsuit further alleges that approximately 5 GB of data was exposed.
Patients can view the publicly reported ransomware listing through Payload's ransomware leak site listing for Internal Medicine and Pediatrics of Cullman.
IMPC is located at:
Internal Medicine and Pediatrics of Cullman, P.C.
1890 Alabama Highway 157, Suite 430, Cullman, Alabama 35058
The lawsuit alleges that cybercriminals accessed and removed patient information due to inadequate cybersecurity safeguards, deficiencies in employee training, and failures to detect or stop the intrusion in a timely manner.
What Information May Have Been Exposed?
According to the complaint, the following categories of information may have been compromised:
- Full names
- Dates of birth
- Social Security numbers
- Driver's license numbers
- Financial account information
- Medical diagnoses
- Treatment records
- Prescription and medication information
- Dates of service
- Provider names
- Medical record numbers
- Health insurance information
The combination of medical information and identifying information can create a particularly serious risk for victims. According to the lawsuit, the exposed data may include enough information to facilitate identity theft, financial fraud, medical identity theft, and other forms of misuse.
Why This Breach Could Have Long-Term Consequences
Healthcare data is among the most valuable information sold on cybercrime marketplaces.
Unlike a password, a Social Security number generally cannot be changed easily. When medical records, insurance information, dates of birth, and Social Security numbers are exposed together, criminals can build highly detailed identity profiles that can be exploited for years.
The complaint describes these identity packages as "Fullz" profiles - complete sets of personal information that can be sold repeatedly on dark web marketplaces.
Potential consequences of a healthcare data breach may include:
- Fraudulent credit applications
- Unauthorized loans or financial accounts
- Tax refund fraud
- Medical identity theft
- Insurance fraud
- Phishing and social engineering scams
- Long-term monitoring costs
The lawsuit also cites research indicating that identity theft victims often do not discover misuse of their information for months or even years after a breach occurs.
Patients May Not Have Been Warned Immediately
One of the central allegations in the lawsuit is that affected individuals had not yet received individualized notification letters when the complaint was filed on May 28, 2026.
Federal healthcare privacy rules generally require covered entities to notify affected individuals after discovering a breach involving unsecured protected health information. According to the U.S. Department of Health and Human Services, affected individuals generally must be notified without unreasonable delay and no later than 60 days after discovery of a reportable breach.
The Alabama Data Breach Notification Act also requires organizations that collect sensitive personal information to maintain reasonable security measures designed to protect that information.
Without timely notice, patients lose valuable time to:
- Freeze their credit
- Monitor financial accounts
- Watch for suspicious activity
- Replace compromised credentials
- Protect themselves from identity theft
A Lawsuit Has Already Been Filed
On May 28, 2026, a proposed class action lawsuit was filed in the Circuit Court of Cullman County, Alabama.
The lawsuit asserts claims that include:
- Negligence
- Negligence per se
- Breach of implied contract
- Unjust enrichment
The complaint also alleges failures relating to cybersecurity safeguards, HIPAA compliance, breach notification obligations, and protection of patient information.
The case seeks damages and other relief on behalf of individuals whose information may have been compromised.
What Adult Patients Should Do Right Now
If you were an adult patient of IMPC, consider taking proactive steps to protect yourself.
1. Review Your Credit Reports
You can obtain free credit reports through AnnualCreditReport.com.
Look for accounts, inquiries, or activity you do not recognize.
2. Place a Credit Freeze
A credit freeze can help prevent criminals from opening new accounts in your name.
You can freeze your credit with:
- Equifax
- Experian
- TransUnion
3. Monitor Medical and Insurance Statements
Review Explanation of Benefits (EOB) forms and medical billing records carefully.
Unexpected claims, services, prescriptions, or providers may be warning signs of medical identity theft.
4. Watch for Phishing Attempts
Cybercriminals often use stolen healthcare information to create convincing emails, phone calls, and text messages.
Be cautious when responding to messages claiming to be from healthcare providers, insurers, or financial institutions.
5. Report Identity Theft Quickly
If you suspect your information has been misused, visit IdentityTheft.gov.
The Federal Trade Commission provides recovery plans and reporting tools for identity theft victims.
Frequently Asked Questions
How do I know if I was affected?
According to the allegations in the lawsuit, any current or former IMPC patient may have been impacted. As of the filing of the complaint, individual notification letters had reportedly not yet been sent.
Was medical information involved?
The complaint alleges that diagnoses, treatment information, prescription information, insurance records, and other healthcare data may have been exposed.
Can I take legal action if my information was exposed?
Every situation is different. Individuals affected by a healthcare data breach may have legal rights depending on the circumstances, the information involved, and any resulting harm.
Why is healthcare information valuable to criminals?
Medical records often contain a combination of identifying information, insurance details, and personal data that can be used to commit financial or medical fraud and to commit identity theft. Unlike passwords, much of this information cannot easily be changed.
Why Patients Are Paying Attention to This Case
Healthcare providers routinely collect some of the most sensitive information people possess. Patients generally have little choice but to provide that information when seeking medical care.
When allegations involve the exposure of Social Security numbers, medical records, insurance information, and other protected data together, the potential consequences can extend far beyond the initial incident.
For many affected individuals, the greatest concern is not simply what happened in May 2026, but what could happen months or years later if the information is misused.
Learn Your Legal Options For The Data Breach Lawsuit
If you believe your personal information may have been exposed in the IMPC breach, learning about your rights sooner rather than later can help you make informed decisions.
Cory Watson Attorneys has represented individuals and families in complex litigation for decades, including cases involving privacy violations, consumer protection issues, and large-scale data breaches.
Sources
- U.S. Department of Health & Human Services – HIPAA Breach Notification Rule
- 45 CFR section 164.404 – Notification to Individuals
- Alabama Code section 8-38-3 – Alabama Data Breach Notification Act
- Alabama Attorney General – Data Breach Notification Requirements
- Spears v. Internal Medicine and Pediatrics of Cullman, P.C. Complaint
Legal Disclaimer
The information contained in this article is provided for general informational purposes only and does not constitute legal advice. Reading this article does not create an attorney-client relationship with Cory Watson Attorneys or any of its attorneys. The allegations discussed herein are based on claims made in a filed lawsuit. Every legal matter is unique, and outcomes depend on the specific facts and applicable law.bsite.hip. Laws and deadlines vary by jurisdiction.