2 Software Firms Report Major Health Data Theft Hacks

Ocuco, an Ireland-based provider of eye care practice and optical laboratory software, and Episource, a California-based medical coding services firm, have reported separate hacking incidents to U.S. and state regulators that have likely affected dozens of their clients and hundreds of thousands of people.

See Also: Top 10 Technical Predictions for 2025

Dublin, Ireland-based Ocuco, which says it provides software and services to 6,750 client sites in 88 countries, reported to the U.S. Department of Health and Human Services on May 30 that its hacking incident involving a network server affected nearly 241,000 individuals.

Ransomware gang KillSec on its dark web leak site claims to have more than 340 gigabytes of Ocuco’s data, including 670,344 files and 26,838 folders.

An Ocuco spokesperson in a statement provided to Information Security Media Group on April 1 said that the company learned through a posting on a dark web site that “a third party” claimed to have stolen information from Ocuco’s environment.

“We immediately took steps to secure our virtual environment and launched an investigation to determine if this claim was legitimate by engaging external cybersecurity experts,” the statement said.

“Our investigation determined that there was unauthorized access to two of our non-production servers and certain files stored therein, which was enabled by a newly discovered vulnerability – that was not timely disclosed to Ocuco – contained within third-party software we use on those systems,” the Ocuco statement said.

“We have fully patched the vulnerability and implemented other additional security processes and procedures to further strengthen our overall cybersecurity posture.”

Ocuco said it is still in the process of performing a detailed review of the files that were involved in the incident to identify individuals whose information may have been contained in the files.

“As soon as this process has been completed, we will start the process of notifying relevant parties and individuals, as well as providing resources to help protect their personal information, in accordance with applicable law,” Ocuco said.

“We have also undertaken a general review of our cybersecurity controls and procedures with a focus on maintaining the highest levels of security for our network, systems and data as we move forward.”

Ocuco did not immediately respond to ISMG’s request for other details about the incident, including the number of individuals potentially affected globally and the type of third-party software vulnerability exploited in the hack.

Episource Hack

Meanwhile, Episource LLC, based in Gardena, Calif., has started notifying individuals in several states, including California and Texas, about a ransomware incident discovered in February.

In the Lone Star State alone, Episource told regulators that the incident affected 24,259 individuals. The company’s report to California’s attorney general does not say how many were affected in that state. As of Friday, Episource’s hacking incident has not yet appeared on the HHS’ Office for Civil Rights HIPAA Breach Reporting Toolwebsite listing health data breaches affecting 500 or more individuals.

Episource provides medical coding and risk adjustment software and services to healthcare sector clients. Some of those affected clients this week also began issuing public notices about the incident, including healthcare delivery system Sharp HealthCare in California and health insurer Horizon Blue Cross Blue Shield of New Jersey.

“On April 24, Episource, a Sharp HealthCare and Sharp Community Medical Group business associate, confirmed Sharp was one of their customers affected by a ransomware data breach,” Sharp said in its breach notice.

“Immediately after becoming aware of the vulnerability, Episource stopped access to their system application and began a thorough investigation to determine if our information was affected. That investigation confirmed that Sharp information hosted on the system had been accessed and acquired without authorization between Jan. 27 and Feb. 6, 2025,” Sharp said.

Episource in its breach notice said it notified law enforcement about the incident and hired cybersecurity specialists to help in the response and investigation.

“We learned from our investigation that a cybercriminal was able to see and take copies of some data in our computer systems,” Episource said.

Information affected varies among individuals but potentially includes name, address, phone number, email address, date of birth, health insurance such as health plans/policies, insurance companies, member and group ID numbers, Medicaid-Medicare-government payer ID numbers, medical record numbers, doctors, diagnoses, medicines, test results, images, care and treatment. Social Security numbers were also affected “in limited instances,” Episource said.

Episource did not immediately respond to ISMG’s request for additional details about the hack, including the total number of clients and people affected.

Several large U.S. law firms recently have also issued separate public notices in recent days about the Ocuco and Episource breaches, saying they are investigating the incidents for potential class action litigation. By Friday, at least two proposed class-action lawsuits had been filed so far against Episource in a California federal court involving the company’s breach.

As of Friday, the HHS OCR website shows 314 major data breaches posted so far in 2025 affecting more than 22.3 million individuals. Of those, 113 affecting more than 9.5 million were reported as involving a business associate, such as a software services provider or other third-party vendor.