Notification letters are landing in mailboxes this week from two very different corners of healthcare: a pharmacy benefits manager and a software maker whose tools run allergy clinics.
The pharmacy benefits manager, which handles prescriptions for health plans, government programs, and self-insured employers, spotted odd activity across its network in October 2025. MedImpact Healthcare Systems took until July 17, 2026 to finish the review, told clients in August, and began mailing patient letters on September 23. Exposed data includes names plus addresses, dates of birth, subscriber numbers, Social Security numbers, insurance details, and prescription and treatment information. Neither the number of affected clients nor patients has been disclosed. The Qilin ransomware group claimed the intrusion and listed MedImpact on its leak site last October.
A second notice came from Pennsylvania, where an allergy and immunotherapy software maker warned clinic customers about a network intrusion. Rosch Visionary Systems keeps the platform practices use to manage allergy shots and treatment plans, but its filings do not say when the incident happened, when it was found, or what the attackers did. Clinics that rely on the software, including Allergy, Asthma and Food Allergy Centers and Texas Regional Asthma, Allergy & Immunology Center, have been told. The Lynx gang claimed the attack and has since removed Rosch from its leak site, a pattern that often signals a paid ransom.
Both notices offer credit monitoring. For practices and plans, the pair is a reminder that patient data leaks through billing and clinical software vendors as readily as through their own systems.
