Sites Medical (United States) notified the Indiana Attorney General of a data breach on 2 November 2026. It affected 372 people.
People affected
372people
Reported
2 November 2026Official notice
Time to tell
91 daysfrom 3 August 2026 · the median is 147
What was exposed
The register’s list does not say what was exposed; the notice it links to (under Sources) usually does.
Before the notice: the ransomware gang Storm named Sites Medical on its leak site on 3 September 2026, 60 days before this was reported. Matched by the organisation’s name: the notice itself does not say who the attacker was.
Sites Medical (United States) notified the Indiana Attorney General of a data breach on 2 November 2026. It affected 372 people. The sources do not say how it happened.
What data was exposed in the Sites Medical breach?
The notices and reports so far do not say what was exposed. This page is updated when they do.
How do I know if I was affected?
Organisations normally tell the people whose data was involved, by letter or email, and that notice says what of yours was in it. We cannot look up individual people. If you got a notice, check that it is real, then follow the steps on this page.
Is there a Sites Medical data breach settlement?
No settlement open for claims is on record for Sites Medical as of 15 November 2026. A settlement usually comes a year or more after a breach, if a court approves one. Every open settlement is listed with its deadline.
Is a letter, email or text about the Sites Medical breach real or a scam?
A real notice names the breach, says what data was involved and never asks for a password, a code or a payment. Criminals often send fake notices after a breach is in the news. Do not use links or phone numbers in the message: go to Sites Medical’s own site, or check the letter here.
Privacy Unpacked