IPPC Data Breach Exposes Sensitive Patient and Financial Information Across Six States
In a significant cybersecurity incident, IPPC a long-term care pharmacy services provider operating under IPPC of New York and Innovative Pharmacy disclosed a data breach involving unauthorized access to its network. The breach occurred over a two-day period (September 18–19, 2025), during which an unknown actor copied and potentially viewed sensitive files.
A review of the affected data, completed by February 9, 2026, revealed that compromised information may include:
- Personal identifiers: Names, birth dates, Social Security numbers, driver’s license/government ID numbers, passport numbers, and taxpayer identification numbers.
- Medical data: Medicare/Medicaid IDs, diagnosis/treatment details, medical record numbers, prescription information, provider names, and admission/discharge dates.
- Financial records: Payment card details, bank account information, billing/claims data, and health insurance information.
IPPC serves patients across New York, New Jersey, Pennsylvania, Delaware, Maryland, and Virginia. The company has begun notifying affected individuals, though the full scope of the breach remains under investigation.
Legal professionals are examining the incident to determine whether a class action lawsuit could be filed on behalf of impacted individuals, citing potential harms such as privacy violations, financial losses, and time spent mitigating the breach’s effects. The investigation aims to hold IPPC accountable for safeguarding the entrusted data.
Source: https://www.classaction.org/data-breach-lawsuits/ippc-april-2026
IPPC Pharmacy cybersecurity rating report: https://www.rankiteo.com/company/ippc-pharmacy
"id": "IPP1775255248",
"linkid": "ippc-pharmacy",
"type": "Breach",
"date": "9/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Healthcare',
'location': ['New York',
'New Jersey',
'Pennsylvania',
'Delaware',
'Maryland',
'Virginia'],
'name': 'IPPC (IPPC of New York, Innovative Pharmacy)',
'type': 'Pharmacy Services Provider'}],
'attack_vector': 'Unauthorized Access',
'customer_advisories': 'Notifying affected individuals',
'data_breach': {'data_exfiltration': 'Copied and potentially viewed',
'personally_identifiable_information': ['Names',
'Birth dates',
'Social Security '
'numbers',
'Driver’s '
'license/government '
'ID numbers',
'Passport numbers',
'Taxpayer '
'identification '
'numbers',
'Medicare/Medicaid '
'IDs',
'Medical record '
'numbers',
'Prescription '
'information',
'Provider names',
'Admission/discharge '
'dates',
'Payment card details',
'Bank account '
'information',
'Billing/claims data',
'Health insurance '
'information'],
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Personal identifiers',
'Medical data',
'Financial records']},
'date_detected': '2025-09-18',
'description': 'IPPC, a long-term care pharmacy services provider operating '
'under IPPC of New York and Innovative Pharmacy, disclosed a '
'data breach involving unauthorized access to its network. The '
'breach occurred over a two-day period (September 18–19, '
'2025), during which an unknown actor copied and potentially '
'viewed sensitive files. The compromised information includes '
'personal identifiers, medical data, and financial records.',
'impact': {'data_compromised': 'Personal identifiers, medical data, financial '
'records',
'identity_theft_risk': 'High',
'legal_liabilities': 'Potential class action lawsuit',
'payment_information_risk': 'High'},
'investigation_status': 'Ongoing',
'regulatory_compliance': {'legal_actions': 'Potential class action lawsuit'},
'response': {'communication_strategy': 'Notifying affected individuals'},
'title': 'IPPC Data Breach Exposes Sensitive Patient and Financial '
'Information Across Six States',
'type': 'Data Breach'}