Conifer Value-Based Care Data Breach Exposes Sensitive Patient Information
On August 28, 2025, Conifer Value-Based Care, LLC a Dallas-based subsidiary of Conifer Health Solutions detected unauthorized access to an employee’s Microsoft Office 365 business email account. The breach, which occurred over two days (August 28–29), compromised a standalone email account but did not affect Conifer’s internal networks or systems.
Conifer responded by securing the account and launching an investigation, which concluded that sensitive personally identifiable information (PII) and protected health information (PHI) may have been exposed. Affected data includes names, dates of birth, health insurance details (such as insurer names, subscriber information, and claims data), and medical records (including diagnoses, treatment details, and prescription information).
Notifications to healthcare providers and health plans were sent by November 14, 2025, with address verification for impacted individuals finalized on December 5, 2025. While no evidence of misuse has been reported, the exposed data could be exploited for identity theft or fraud.
Conifer Value-Based Care, part of Conifer Health Solutions, provides administrative and revenue cycle services to hospitals, health systems, and insurers nationwide, managing billions in patient revenue annually. The incident is now under investigation by Shamis & Gentile P.A., a law firm specializing in data breach class actions, which is evaluating potential compensation claims for affected individuals.
Source: https://www.claimdepot.com/investigations/conifer-health-solutions-data-breach-2026
Conifer Health Solutions cybersecurity rating report: https://www.rankiteo.com/company/conifer-health-solutions
Conifer Health Solutions cybersecurity rating report: https://www.rankiteo.com/company/conifer-health-solutions
"id": "CONCON1768259687",
"linkid": "conifer-health-solutions, conifer-health-solutions",
"type": "Breach",
"date": "8/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Potentially millions of patient '
'interactions',
'industry': 'Healthcare',
'location': 'Dallas, Texas, United States',
'name': 'Conifer Value-Based Care, LLC',
'size': 'Thousands of employees',
'type': 'Healthcare Services Provider'}],
'attack_vector': 'Compromised Email Account',
'customer_advisories': 'Notified affected individuals and provided steps to '
'protect their information',
'data_breach': {'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Name',
'Date of birth',
'Health insurance information',
'Medical information',
'Medical record number',
'Patient account number',
'Provider name',
'Date(s) of service',
'Diagnosis and treatment '
'information',
'Prescription information']},
'date_detected': '2025-08-28',
'date_publicly_disclosed': '2025-11-14',
'description': 'Shamis & Gentile P.A. is investigating the Conifer '
'Value-Based Care, LLC data breach where an unauthorized third '
'party gained access to an employee’s Microsoft Office 365 '
'business email account, potentially exposing sensitive '
'personally identifiable information.',
'impact': {'data_compromised': 'Sensitive personally identifiable information '
'and medical information',
'identity_theft_risk': 'High',
'legal_liabilities': 'Potential lawsuits and compensation claims',
'systems_affected': 'Microsoft Office 365 business email account '
'(separate from internal network and systems)'},
'initial_access_broker': {'entry_point': 'Microsoft Office 365 business email '
'account'},
'investigation_status': 'Ongoing',
'recommendations': ['Review statements from healthcare providers and '
'insurance companies for unusual activity',
'Report questionable charges immediately',
'Place a fraud alert on your credit file',
'Request a security freeze from credit bureaus',
'Stay alert for communications regarding the breach',
'Report signs of identity theft to law enforcement, state '
'attorney general, and the Federal Trade Commission'],
'references': [{'source': 'Shamis & Gentile P.A.'}],
'regulatory_compliance': {'legal_actions': 'Potential lawsuits and '
'compensation claims'},
'response': {'communication_strategy': 'Notified healthcare providers and '
'health plans by Nov. 14, 2025; '
'address verification completed by '
'Dec. 5, 2025',
'containment_measures': 'Immediate steps to contain the threat',
'incident_response_plan_activated': 'Yes',
'remediation_measures': 'Investigation launched, review '
'completed to identify affected '
'individuals'},
'threat_actor': 'Unauthorized third party',
'title': 'Conifer Value-Based Care, LLC Data Breach Investigation',
'type': 'Data Breach',
'vulnerability_exploited': 'Unauthorized access to Microsoft Office 365 '
'business email account'}