What happened in the Unlimited Technology Systems data breach?

Unlimited Technology Systems, LLC, also known as Unlimited Systems, recently disclosed a data breach involving personal and protected health information maintained through its healthcare practice-management services. Because Unlimited provides software to healthcare organizations and medical providers, the affected information may belong to patients and related individuals who have no direct relationship with Unlimited itself. The incident became public through state regulatory filings and notices issued to patients in July 2026. Unlimited Technology Systems Notice of Data Breach Sample (Iowa)

According to Unlimited’s investigation, an unauthorized actor obtained a copy of personal information from its commercial data center between October 5 and October 10, 2025. Unlimited discovered unauthorized activity in the data center on October 19, 2025. The company then retained an outside cybersecurity forensic firm, notified law enforcement, and reviewed the affected data to determine whose information was involved. Unlimited Technology Systems Submitted Breach Notification Sample (California)

Unlimited has not publicly explained how the unauthorized actor entered the data center. The available notices do not identify phishing, stolen credentials, an exploited software vulnerability, malware, or ransomware as the cause. They also do not name the responsible actor. Accordingly, the confirmed explanation is limited: an unauthorized party gained access to the data-center environment and copied information, but the initial point of entry and specific attack method remain undisclosed.

The information involved varied by individual. It may have included names, Social Security numbers, dates of birth, mailing addresses, email addresses, telephone numbers, and other demographic information. The affected files may also have contained scanned driver’s licenses or other government identification, insurance cards, and patient intake forms. Health-related information potentially involved included medical record numbers, dates of service, diagnosis information, insurance policy numbers, claims or benefits information, and patient balance information.

Unlimited stated that the breach did not involve complete patient medical records, medical imaging, credit card information, or bank-account information. However, the exclusion of full medical records does not mean that all medical information was unaffected; diagnosis information, dates of service, medical record numbers, and insurance information were among the categories that may have been copied. Unlimited also said that, as of its notice, it was unaware of any attempted or actual misuse of information involved in the incident. Unlimited Technology Systems Notice of Data Breach Sample (South Carolina)

In response, Unlimited said it implemented additional security measures intended to reduce the risk of a similar incident. The company is also offering affected individuals two years of complimentary identity-monitoring services through Kroll. The services include single-bureau credit monitoring, fraud consultation, and identity-theft restoration. Eligible recipients must enroll with the activation code and verification ID contained in their individual notice before the stated enrollment deadline. Unlimited established a dedicated assistance line at 844-576-3063, available Monday through Friday from 9:00 a.m. to 6:30 p.m. Eastern Time, excluding major U.S. holidays.

A sample notification appeared in the Iowa Attorney General’s records on July 1, 2026. At least one affected healthcare provider reported that Unlimited began mailing notices on or around July 20, 2026, while California and South Carolina recorded the incident on July 21. The public materials do not state when the data review was completed or explain the interval between the October 2025 discovery and the July 2026 notifications. Astera Cancer Care Notice of Service Provider Data Breach

As of July 23, 2026, Unlimited has not publicly disclosed a nationwide total. The South Carolina Department of Consumer Affairs reports that 148,342 South Carolina residents were affected, establishing that the incident involves at least a six-figure population even before residents of other states are counted. Because Unlimited serves multiple healthcare organizations, the full number of affected individuals could be substantially larger. Hematology & Oncology Consultants Notice of Data Breach

How did the Unlimited Technology Systems breach occur?

The Unlimited Technology Systems data breach occurred when an unauthorized actor entered a commercial data-center environment used by the company and copied personal and protected health information between October 5 and October 10, 2025. Unlimited discovered unauthorized activity on October 19, 2025.

Unlimited has not publicly disclosed how the attacker initially gained access. Its notice does not identify phishing, compromised credentials, an exploited vulnerability, malware, or ransomware as the cause. Therefore, the precise attack method remains unknown. Unlimited Technology Systems Notice of Data Breach Sample (Iowa)

When did the Unlimited Technology Systems breach occur?

The Unlimited Technology Systems data breach occurred between October 5 and October 10, 2025.

How many people were affected by the Unlimited Technology Systems breach?

At least 427,929 people were affected by the Unlimited Technology Systems data breach, based on currently available state reports: Texas: 277,364 residents; South Carolina: 148,342 residents; Massachusetts: 2,223 residents. As of July 24, 2026, Unlimited has not publicly disclosed a nationwide total. Because Unlimited serves various healthcare organizations, the total number of affected individuals could be substantially larger. South Carolina Department of Consumer Affairs

What information was exposed in the Unlimited Technology Systems breach?

• The information exposed in the Unlimited Technology Systems data breach varied by individual and may have included, but is not necessarily limited to:
  • Names
  • Social Security numbers
  • Dates of birth
  • Mailing addresses, email addresses, and telephone numbers
  • Medical record numbers
  • Dates of medical service
  • Diagnosis information
  • Health-insurance policy numbers
  • Claims and benefits information
  • Patient account-balance information
  • Scanned driver’s licenses or other government identification
  • Insurance cards
  • Patient intake forms
  • Other demographic information
  Unlimited stated that the breach did not involve complete medical records, medical images, credit card information, or bank-account information. Nevertheless, the exposed data may have included both sensitive identifying information and protected health information. The precise information affected was different for each person. Unlimited Technology Systems Submitted Breach Notification Sample (California)

Has Unlimited Technology Systems offered free credit monitoring and/or identity theft protection services?

Yes. Unlimited Technology Systems is offering eligible affected individuals two years of complimentary identity-monitoring services through Kroll. The services include: Single-bureau credit monitoring, Fraud consultation, and Identity-theft restoration assistance. Affected individuals must enroll using the activation code and verification ID provided in their notification letter before the stated enrollment deadline. Unlimited Technology Systems Notice of Data Breach Sample (Iowa)

Unlimited Technology Systems data breach timeline:

Date	Event
October 5, 2025	An unauthorized actor began accessing Unlimited Technology Systems’ commercial data-center environment and copying files containing personal information and protected health information.
October 10, 2025	The period of unauthorized access and data acquisition ended. Unlimited has not disclosed the attacker’s method of entry.
October 19, 2025	Unlimited discovered unauthorized activity within the data center. The company retained a cybersecurity forensic firm, notified law enforcement, and began investigating the incident and reviewing the affected data.
UNDISCLOSED	Data breach investigation concluded.
July 1, 2026	Unlimited submitted a sample data breach notification to the Iowa Attorney General’s Office, publicly disclosing the incident approximately nine months after it occurred.
Around July 20, 2026	Unlimited began mailing data breach notification letters to affected individuals for whom sufficient mailing addresses were available. The company offered eligible recipients two years of complimentary identity-monitoring services through Kroll.

Who is Unlimited Technology Systems?

Unlimited Technology Systems, LLC, which operates as Unlimited Systems, is a Cincinnati-based healthcare software company founded in 2003. Unlimited Technology Systems, LLC -- Company Profile The company develops practice-management and revenue-cycle technology for specialty healthcare organizations, including independent practices, medical groups, hospitals, and health systems. Its Unlimited Financials platform supports administrative and financial functions such as patient intake, scheduling, insurance verification, claim processing, payment posting, accounts-receivable management, and reporting. Unlimited Technology Systems, LLC -- Platform Overview

What should you do if you received a Unlimited Technology Systems data breach letter?

If you received an Unlimited Technology Systems data breach letter, first confirm that the notice is addressed to you and determine which types of your information were affected. Keep the letter because it contains a unique activation code and verification ID needed to enroll in the complimentary services being offered. Unlimited is providing eligible individuals with two years of free identity monitoring through Kroll, including single-bureau credit monitoring, fraud consultation, and identity-theft restoration assistance. Enroll before the deadline stated in your letter.

Because the compromised information may include Social Security numbers, dates of birth, driver’s-license information, and other sensitive identifiers, consider placing a free security freeze with all three major credit bureaus—Equifax, Experian, and TransUnion. A freeze generally provides stronger protection than credit monitoring because it restricts access to your credit file, making it more difficult for someone to open a new account in your name. You may alternatively place a fraud alert, although a fraud alert is less restrictive. Kroll’s single-bureau monitoring does not replace freezing or reviewing all three credit reports.

Review your credit reports for unfamiliar accounts, inquiries, addresses, or other suspicious activity. Free weekly reports from all three bureaus are available through AnnualCreditReport.com, the federally authorized website. Continue monitoring bank, credit-card, insurance, and healthcare records. Because the breach may have included diagnosis, insurance, claims, and medical-record information, examine medical bills, insurance explanations of benefits, and patient-portal activity for services or claims you do not recognize.

Be cautious of calls, emails, and text messages that refer to the breach or contain personal medical details. That information could be used to make phishing attempts appear legitimate. Do not provide passwords, Social Security numbers, activation codes, or financial information in response to unsolicited communications. If a password associated with a healthcare account was reused elsewhere, change it and enable multifactor authentication where available.

If you discover identity theft or unauthorized activity, contact the relevant financial institution, insurer, or healthcare provider promptly and report the incident at IdentityTheft.gov. Unlimited’s official notice also lists a dedicated assistance line at 844-576-3063, available Monday through Friday from 9:00 a.m. to 6:30 p.m. Eastern Time, excluding major U.S. holidays.

Unlimited Technology Systems Data Breach Notice

The notice describes the Unlimited Technology Systems data breach, including the type of information that may have been involved and the steps offered to affected individuals.

Open the Unlimited Technology Systems Data Breach Notice in a New Tab

Sources and additional information about the data breach:

• • Unlimited Technology Systems Website
  • Unlimited Technology Systems Website
  • Hematology & Oncology Consultants Notice of Data Breach
  • Unlimited Technology Systems Submitted Breach Notification Sample (California)
  • Unlimited Technology Systems Notice of Data Breach Sample (Iowa)
  • Unlimited Technology Systems Notice of Data Breach Sample (South Carolina)
  • South Carolina Department of Consumer Affairs
  • FTC Consumer Advice: Identity Theft
  • IdentityTheft.gov
  • IRS Identity Theft Guide for Individuals
  • U.S. Department of Health and Human Services Office of Inspector General: Medical Identity Theft
  • IdentityTheft.gov: What To Do if Your Information Was Lost or Stolen, or Part of a Data Breach

Class Action FAQ

About This Data Breach Resource

This page was created to give affected individuals and researchers a clear, comprehensive explanation of the Unlimited Technology Systems data breach. It summarizes what is currently known about the incident, including the timeline, how the breach was discovered, the types of information involved, the number of people affected when available, important notice dates, and steps individuals may want to take after receiving a data breach notification.

This resource is independently written and organized to help readers understand the breach without having to review multiple notices, state attorney general filings, company statements, and related materials. When available, this page relies on primary sources and identifies key facts, unanswered questions, and updates as new information becomes public.

This page is especially relevant for readers searching for information about the Unlimited Technology Systems data breach, Unlimited Technology Systems data breach notice, Unlimited Technology Systems class action investigation, what information was exposed, how many people were affected, and what affected individuals should do next.

Abington Cole + Ellery reviews data breach incidents involving sensitive personal information, financial information, and protected health information. This page is intended to help affected individuals understand the publicly reported facts, the types of information that may have been involved, and practical steps that may reduce the risk of identity theft or medical identity theft.

The information on this webpage is provided for general informational purposes only and does not constitute legal advice. Nothing on this page should be relied upon as legal advice for any particular situation. Submitting information through this page does not create an attorney-client relationship.

For more information about steps you can take to possibly reduce the risk harm arising from a data breach, please review the following article: What are some steps you can take if you've been the victim of a data breach?

This website is not associated with nor authorized by Unlimited Technology Systems or any affiliated companies. If you have received any other data breach notifications, you may want to review Abington Cole + Ellery's current list of data breach investigations.