Wheelchair Firm Ramps Up Notices to 500,000 for Email Hack

Tennessee-based Numotion, one of the largest U.S. providers of wheelchairs and other health-related mobility products is notifying nearly 500,000 people of a 2024 email hacking incident that potentially compromised their personal and health-related information.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

United Seating and Mobility, LLC – which operates under the name Numotion – reported the hacking/IT incident to federal regulators on March 7 as affecting 494,326 people.

The company in a breach notice posted on its website said the hack was triggered by a phishing email that led to “someone” accessing employee email accounts without authorization on several occasions between Sept. 2, 2024 and Nov. 18, 2024.

The information that may have been compromised varies among individuals, but could have included names, dates of birth, product information, payment and financial account information, health insurance information and medical information. For “a minority” of individuals, Social Security numbers and driver’s license numbers were also affected.

“Numotion has no reason to believe that anyone was trying to access personal information in the accounts, and there is no indication that any information has been used for fraud or identity theft,” the company said. Individuals whose Social Security numbers were affected are being offered complimentary credit and identity monitoring, Numotion said.

Numotion in a statement to Information Security Media Group said that upon discovery of the incident, the company immediately secured the affected accounts and initiated an internal investigation.

“To ensure the security of our email and computer systems, we engaged a forensic security firm to conduct a thorough review. We are pleased to confirm that no other systems were impacted by the incident,” the company said.

In the wake of the incident, Numotion is continuing to review and improve its technical security measures “to stay ahead of emerging threats,” the company told ISMG.

As of Monday, Numotion appeared to face at least five proposed federal class action lawsuits involving the data breach.

The complaints make similar claims against Numotion, including allegations that the company was negligent in failing to properly secure individuals’ sensitive information, putting plaintiffs and class members at risk for identity theft and fraud. The lawsuits also seek similar relief, including financial damages and an injunctive order for Numotion to improve its data security practices.

Numotion declined ISMG’s request for comment on the proposed class action lawsuits that the company is facing.

Preventing Email Breaches

As of Monday, the Numotion incident was the third-largest health data breach reported to the U.S. Department of Health and Human Services so far in 2025 – and largest of health data breach this year reported to HHS as involving email.

Security firm Paubox, in a recent research report, analyzed 180 major health data breaches posted on the HHS’ Office for Civil Rights’ HIPAA Breach Reporting Tool website between Jan. 1, 2024 and Jan. 31, 2025 that were reported as involving email compromises.

The most common attack methods used in breaches involving email include phishing, spoofing or impersonation and credential theft. Attackers frequently use email attachments to distribute malware and ransomware. Since 2018, ransomware attacks on healthcare organizations have increased by 264%, according to analysis of HHS OCR breach report data, the Paubox report said.

Paubox in a related survey also found that only 5% of known phishing attacks were reported by employees to their IT security teams.

“Unfortunately, the data reveals a clear trend – HIPAA breaches via email are increasing each year. The trend is expected to continue, as advances in AI are quickly co-opted by bad actors,” Hoala Greevy, CEO of Paubox told ISMG.

To help prevent email compromises, it is critical for entities to implement mandatory multifactor authentication across all mailboxes within the organization, with some additional considerations taken, Greevy said. “It’s recommended that an authenticator app like Google Authenticator is used. Sending an MFA code via text is susceptible to SIM swapping,” he said.

“Also known as SIM hijacking, this attack involves fraudulently transferring a victim’s phone number to a SIM card controlled by a bad actor, allowing them to receive calls and texts intended for the victim – including those containing security codes used for MFA.”

Of the health data breaches involving email reported to HHS OCR that Paubox analyzed for its report, 43.3% involved Microsoft 365 as the email security provider; 15% involved Proofpoint; 13% involved Barracuda; 12% involved Mimecast; and 6% Google Workspace.

In the 2025 Paubox Healthcare Email Security Report, over 43% of healthcare organizations that reported a HIPAA breach via email were only using Microsoft 365, with no additional layer of defense, Greevy said.

Organizations should enforce MFA for all email accounts and implement additional layers of defense for both inbound and outbound email, he said.

Organizations also should ensure that their sender policy framework; domain keys identified mail; and domain-based message authentication, reporting and conformance records are correctly configured, he said. “When correctly configured, these records prevent bad actors from impersonating your organization’s domain names via email.”