Wakefield & Associates based in Knoxville, Tennessee, provides healthcare providers with revenue cycle & collections services. Recently, the vendor reported a security incident that was discovered on or about January 17, 2025.
Wakefield & Associates published a data breach notice on its website stating that it had discovered suspicious activity inside its computer network. Forensic investigation revealed unauthorized access to records that belong to its healthcare clients’ patients, which contain protected health information (PHI). Some files had been extracted from its system prior to January 17, 2025. The breach notification submitted to the Maine Attorney General indicated that initial access happened on January 14, 2025.
After a thorough assessment of the breached data, Wakefield & Associates confirmed on September 24, 2025, that some of its healthcare clients’ files containing PHI provided to the vendor were exposed. The data was likely exposed because of the incident, which included names and collection account details. The Social Security number, driver’s license number/state ID number, financial account details, and/or medical data of some individuals were also exposed.
Wakefield & Associates is providing notification letters on behalf of its impacted customers and is providing the affected people with free credit monitoring and identity theft protection services. The company reviewed the active security guidelines and procedures and implemented extra safety measures to avoid similar incidents later on.
The breach notification doesn’t mention the nature of the cyberattack. However, it seems that the Akira threat group conducted the ransomware attack. On February 11, 2025, Akira posted on its dark web data leak site about the stolen 13 GB of data files, which include patient and worker data.
Wakefield & Associates notified law enforcement and reported the data security incident to government regulators. Since late September, the HHS Office for Civil Rights (OCR) has not updated its breach portal because of the government shutdown. Thus, the number of currently affected individuals is uncertain. The Montana Attorney General received a notification that stated 26,624 state locals were impacted. The notification sent to the Maine Attorney General indicated that 41 Maine residents were impacted. Northern Montana Health Care has confirmed that it was affected by the Wakefield & Associates data breach.