A May 2025 cyberattack on ApolloMD exposed the personal data of over 626,000 patients linked to affiliated physicians and practices.
ApolloMD is a US-based healthcare services company that partners with hospitals, health systems, and physician practices. It provides practice management, staffing, revenue cycle, and administrative support services. The company works with affiliated physicians across specialties such as emergency medicine, hospital medicine, anesthesia, and radiology, helping providers manage clinical and operational functions.
ApolloMD disclosed a data breach after a May 2025 cyberattack. The security breach compromised the personal information of more than 626,000 individuals, impacting patients of affiliated physicians and medical practices served by the healthcare management provider.
According to data published by the US Department of Health and Human Services, the exact number of impacted people is 626,540.
Hackers accessed and stole sensitive data, prompting the company to notify impacted individuals.
The company detected unusual activity on May 22, 2025, and launched an investigation with the help of a forensic firm and notified law enforcement. Investigators found that an unauthorized party gained unauthorized access to its IT systems between May 22 and 23, including patient files. The exposed data varies by individual and includes names, birth dates, addresses, diagnoses, treatment details, insurance data, and in some cases Social Security numbers.
ApolloMD notified managed physician practices between July and September 2025.
“Our investigation determined that an unauthorized party accessed ApolloMD’s IT environment between May 22, 2025 and May 23, 2025. While in the IT environment, the unauthorized party may have accessed and/or acquired files that contain information for patients treated by ApolloMD’s affiliated physicians and practices. The information involved varied by patient and includes names in combination with one or more of the following: dates of birth, addresses, diagnosis information, provider names, dates of service, treatment information, and/or health insurance information. For some individuals, the incident may have also involved their Social Security numbers.” reads the notice of security breach published by the company. “On September 17, 2025, notification letters began being mailed to patients whose information may have been involved in the incident.”
ApolloMD did not publish technical details about the incident, however, the Qilin ransomware group claimed the data breach in June 2025.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, data breach)
