ApolloMD reveals that 626,540 patients were affected by May, 2025 cyberattack

ApolloMD disclosed that a May 22–23, 2025 breach compromised protected health information for 626,540 patients of client physician practices, with data types including names, dates of birth, addresses, diagnoses, treatment and insurance details, and some Social Security numbers. The Qilin ransomware gang listed the attack on its leak site in June 2025 and claimed 238 GB of exfiltrated data, though ApolloMD’s substitute notice did not reference ransomware, encryption, or a ransom. ApolloMD reported the incident to HHS this week after patient notifications in September 2025, prompting questions about the delay and whether any ransom was paid; no leaked data has been posted to date.