Highlands Oncology Group PA (“Highlands”) recently discovered a data incident that may have involved the personal information for certain individuals. On June 2, 2025, Highlands discovered it was the victim of a cyber-attack, and certain Highlands files and systems were inaccessible. Upon discovering the incident, Highlands promptly began an internal investigation, worked to secure its systems, and notified law enforcement. Highlands also engaged a forensic security firm to assist with its investigation and ensure the security of its computer network. The forensic investigation determined that an unauthorized third party accessed Highlands’ computer network at times between January 21, 2025, and June 2, 2025, and encrypted some of its files. The investigation also determined that the third party may have accessed and acquired certain files from Highlands’ systems during this period.
Based on the results of its investigation, Highlands analyzed the affected files to identify individuals whose information may have been accessed or acquired without authorization during the incident. Highlands determined that the files may contain personal information for certain individuals. Depending on the individual, the personal information may include their name, date of birth, Social Security number, driver’s license/state identification number, passport number, credit/debit card number, financial account number, medical treatment information, medical record number, patient account number, and/or health insurance policy information. On August 1, 2025, Highlands began mailing notification letters to those individuals whose information was in the files for whom Highlands has a valid mailing address.
Notified individuals should refer to the notice they will receive in the mail regarding steps they can take to protect themselves. Although Highlands has no evidence that any information may have been misused as a result of this incident, as described in those letters, Highlands Oncology has arranged for complimentary identity theft protection services for those individuals whose Social Security numbers and/or driver’s license/state ID numbers were involved in the incident. As a precautionary measure, individuals should remain vigilant to protect against potential fraud and/or identity theft by, among other things, reviewing their account statements and monitoring credit reports closely. If individuals detect any suspicious activity on an account, they should promptly notify the financial institution or company with which the account is maintained. They should also promptly report any fraudulent activity or any suspected incidents of identity theft to proper law enforcement authorities, including the police and their state’s attorney general. Notified individuals may also wish to review the tips provided by the Federal Trade Commission (“FTC”) on fraud alerts, security/credit freezes and steps that they can take to avoid identity theft. For more information and to contact the FTC, please visit www.ftc.gov/idtheft or call 1-877-ID-THEFT (1-877-438-4338). Notified individuals may also contact the FTC at: Federal Trade Commission, 600 Pennsylvania Avenue, NW, Washington, DC 20580.
Contact information for the three national credit reporting agencies is as follows:
Equifax
Phone: 1-800-349-9960
Website: www.equifax.com
Address: P.O. Box 105788, Atlanta, GA 30348
Experian
Phone: 1-888-397-3742
Website: www.experian.com
Address: P.O. Box 9554, Allen, TX 75013
Transunion
Phone: 1-800-888-4213
Website: www.transunion.com
Address: P.O. Box 1000, Chester, PA 19016
Highlands Oncology is committed to maintaining the privacy and security of the information entrusted to it. Highlands has taken, and is taking, additional steps to help reduce the likelihood of a similar event from happening in the future, including enhancing its technical security measures. Individuals seeking additional information may call a confidential, toll-free inquiry line at 877-250-2776 from 8:00 a.m. – 8:00 p.m. Central Time, Monday through Friday.
