Center for Urologic Care (CUC) Practice in Pennsylvania Reports Data Breach After Weeks-Long Network Intrusion

The Center for Urologic Care of Berks County (CUC) informed its patients when it learned this Fall that an unauthorised individual was able to access files maintained on its computer network, which is one of the largest urology practices serving the Greater Reading area. The incident marks another entry in a long list of data breaches affecting physician-owned practices and raises questions about whether medical records are safe when stored outside large hospital systems.

CUC opened an investigation into the questionable activity discovered on 9/24/2025 and enlisted the services of outside cybersecurity experts to assist in determining if any of its patients' records were being accessed without authorisation. The investigation revealed that access was gained to various portions of the CUC's network from 9/24 through 10/13 — a timeframe of approximately three weeks.

Within that timeframe, certain records that were able to be accessed by the unauthorised individual contained medical information. In early November, investigators with CUC verified that records involved included both identifying information about patients and protected health information (PHI). CUC began the process of reviewing affected medical records from 9/28 through 11/6 in order to determine who, if any, patients were affected and 11/26/2025, CUC formally announced this incident and began mailing the affected patients notification letters.

The practice’s report suggests that the exposed information may include names, Social Security numbers, diagnoses, names of treating physicians, prescriptions, medical test results, imaging files, and treatment details. Several of these categories — especially medical images and diagnostic records — are considered highly sensitive because they cannot be easily replaced or changed once compromised. Security analysts note that this type of data can hold long-term value for cybercriminals, particularly when combined with identifiers like dates of birth or Social Security numbers.

CUC, headquartered in Wyomissing, Pennsylvania, has served the community for more than two decades, offering both routine and specialized urologic care. The practice is known as the largest urology provider in Berks County, treating both adult and pediatric patients. As with many mid-sized medical practices, CUC maintains detailed electronic health records that contain extensive clinical history — the very type of information that has increasingly become a target for cyberattacks.

Following detection of the breach, the practice reported taking steps to secure its systems and limit the potential for further unauthorized activity. Cybersecurity firms assisting with the investigation are analyzing digital logs, system snapshots, and network traffic patterns to determine how the attacker entered the environment and whether any data has been misused. As of now, CUC has not publicly disclosed how the intrusion occurred or whether the unauthorized party attempted to alter or exfiltrate data beyond accessing stored files.

Federal law requires healthcare organizations to report breaches involving protected health information to the U.S. Department of Health and Human Services’ Office for Civil Rights. The agency will review the incident as part of its oversight of HIPAA-regulated entities, a process that often includes evaluating technical safeguards, administrative procedures, and the timeliness of patient notifications.

For patients receiving notification letters, experts recommend reviewing medical and insurance statements closely for irregularities. Unfamiliar procedures, unexpected claims, or incorrect provider listings could indicate misuse of health information. Individuals whose Social Security numbers were exposed may benefit from placing fraud alerts or security freezes on their credit reports, a common precaution in cases involving identity-related risks.

CUC stated that it will continue updating affected individuals as its investigation progresses. The practice also emphasized that protecting patient information remains a priority and that additional security enhancements are underway.

As healthcare practices continue to adopt broader digital systems, breaches like the one at CUC illustrate the ongoing challenges that medical groups face in protecting sensitive information. While large hospital networks often receive the most attention, incidents at privately owned specialty practices reveal how widespread cybersecurity risks have become across all levels of the healthcare system.

My Data Breach Attorney is monitoring updates as additional findings from the investigation become available. https://mydatabreachattorney.com/case/center-for-urologic-care-cuc-data-breach/