Illinois cardiology practice sued over data breach
A class action lawsuit has been filed against Heart Care Centers of Illinois (HCCI) over a patient data breach the company first announced on July 18. The practice, based in the Chicago suburb of Palos Park, said some protected information may have been subject to unauthorized access through an employee's email account.
HCCI said it discovered the data security incident Jan. 15, 2026, while investigating an unsuccessful phishing attempt. But a third-party data analytics investigation firm found previous suspicious activity from the employee’s email account from a phishing attack that resulted in unauthorized access to the employee’s account from Aug. 22 to Nov. 6, 2024.
HCCI said it took steps to remediate the unauthorized activity earlier this year
"Importantly, HCCI does not have any reason to believe that there has been any identity theft, fraud or misuse of information in connection with this incident," the practice said in a notice to patients.
However, HCCI explained in the notice that the information that may have been accessed varies by individual and could include patient names, mailing address, social security number, date of birth, driver’s license number or state identification number, credit card payment information, financial account number and passport number. The letter also said the breach may include medical information on specific patients, including treatment, condition and diagnosis, prescriptions, health insurance information and telephone number.
HCCI mailed notification letters to potentially affected patients July 10, 2026, and offered to provided them with access to free credit monitoring and identity restoration services.
A class action lawsuit was filed in Cook County Circuit Court on July 22 by the law firm Strauss Borrelli PLLC on behalf of a patient. It is among several law firms looking to create class action suits related to this incident. The first court date is set for Sept. 21 in Chicago.
HCCI has 26 cardiologists that specialize in minimally invasive, noninvasive and electrophysiology therapies, serving patients in the Southeast Chicago suburbs between Joliet and Berwyn.
Email phishing cyber attacks against healthcare system or practice employees are a common way criminals gain access to protected health data. Attackers often pretend to be trusted companies or individuals and get the employees to click on website links or open attachments that then enable unauthorized access. These types of attacks often occur without the employee realizing it.
Dave Fornell has covered healthcare for more than 17 years, with a focus in cardiology and radiology. Fornell is a 5-time winner of a Jesse H. Neal Award, the most prestigious editorial honors in the field of specialized journalism. The wins included best technical content, best use of social media and best COVID-19 coverage. Fornell was also a three-time Neal finalist for best range of work by a single author. He produces more than 100 editorial videos each year, most of them interviews with key opinion leaders in medicine. He also writes technical articles, covers key trends, conducts video hospital site visits, and is very involved with social media. E-mail: [email protected]