Rocky Mountain Oncology Care Data Breach Lawsuit Investigation
Received a shocking letter from Rocky Mountain Oncology Care? A recent phishing attack has exposed sensitive data for 10,268 patients. Act now—learn what was compromised and whether you can pursue a claim for compensation.
Quick Facts
- Breach window: December 13–16, 2024
- Discovered: May 9, 2025
- Individuals affected: 10,268 patients
- Type of attack: Phishing leading to email & SharePoint compromise
- Owner/Administrator: Integrated Oncology Network (ION)
What Happened?
Investigators for Integrated Oncology Network found that cyber-criminals tricked employees into revealing credentials or clicking malicious links. This gave the intruders access to multiple email accounts and SharePoint files used by Rocky Mountain Oncology Care between December 13 and December 16, 2024. The intrusion was confirmed on May 9, 2025, prompting immediate containment, forensic review, and patient notification.
What Information Was Exposed?
Both personally identifiable information (PII) and protected health information (PHI) may have been compromised, including:
- Full names and addresses
- Dates of birth & Social Security numbers
- Government-issued ID numbers
- Financial account details
- Diagnosis, lab results & medication records
- Treatment information, provider names & service dates
- Health insurance and claims data
Your Next Steps
Rocky Mountain Oncology Care is mailing notices and offering credit-monitoring services. Even so, you must stay vigilant:
- Enroll in any free credit or identity-monitoring program provided.
- Monitor bank, credit-card, and insurance statements for unauthorized activity.
- Request a free fraud alert or credit freeze with Equifax, Experian, or TransUnion.
- Report suspicious emails, calls, or medical bills you don’t recognize.
Can You File a Lawsuit?
Under state and federal laws, healthcare providers have a duty to safeguard your data. If negligence contributed to the breach—or if you suffer financial loss, identity theft, or emotional distress—you may be entitled to compensation for:
- Out-of-pocket expenses (credit services, phone bills, postage)
- Time spent mitigating fraud
- Unreimbursed financial losses
- Emotional distress or loss of privacy
Class-action investigations are underway. Submitting a claim preserves your right to share in any settlement or judgment.
Timeline of Key Events
- Dec 13–16, 2024 – Unauthorized access to email and SharePoint.
- May 9, 2025 – ION concludes forensic investigation.
- Jun 13, 2025 – Oncology practices notified.
- Jun 27, 2025 – Patient letters mailed & breach reported to HHS.
Download the Official Breach Notice
Download Official Breach Notice (PDF)FAQ: Rocky Mountain Oncology Care Data Breach
How do I know if my Rocky Mountain Oncology Care data was involved?
Patients whose information was in the compromised email or SharePoint files should receive a mailed notice. If your contact info changed recently, call Rocky Mountain Oncology Care to confirm your status.
What is Rocky Mountain Oncology Care offering affected patients?
The practice states it is offering complimentary credit-monitoring and identity-protection services. Details and activation codes are included in the mailed notice.
Will signing up for monitoring waive my right to sue Rocky Mountain Oncology Care?
No. Accepting free monitoring does not prevent you from pursuing legal action or joining a class-action lawsuit related to the breach.
How long do I have to file a claim against Rocky Mountain Oncology Care?
Deadlines vary by state—often two to four years from the date you knew or should have known about the breach. Acting quickly helps preserve evidence and your legal rights.
What can a lawsuit accomplish?
A successful lawsuit can provide monetary compensation, require stronger security measures, and hold the organization accountable for failing to protect patient data.
Protect Yourself—Take Action Today
If you received a breach notice, don’t wait. Secure your credit, gather documentation of any suspicious activity, and explore your legal options to recover losses and safeguard your identity.