Privacy Unpacked

Incident · one vendor, 2 organisations

The Episource breach

26 January 2026 to 9 February 2026

2 organisations on the tracker had data taken through Episource, which reported its own breach on 9 February 2026. Each one is listed with the words of the source that names Episource.

The vendor

  1. EpisourceUSUnited States · CA · 9 February 2026 Social Security numbersHealth insurance detailsHealth and medical information+3 351.6KTexas residents

Organisations affected through Episource

  1. Brown & Toland PhysiciansUSUnited States · 26 January 2026 –not reported
    This letter is from Episource, LLC ("Episource" or "We"). We work with doctors, health plans, and other health companies, including <<CUSTOMER NAME>>. This event may have involved your data. notice letter

Counts are each organisation’s own and can overlap: one person can be a customer of several. An organisation joins this list only when a source names Episource as the way its data was taken.

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Found a mistake? Tell us and we correct it.