Almeida Law Group is investigating a data breach at Sierra Management Group. If you were affected, contact Almeida Law Group.
About Sierra Management Group
Sierra Management Group, Inc. is a Management Services Organization (MSO) based in Newcastle, California that provides medical practice management and consulting services to independent physicians across specialties including primary care, general surgery, allergy, and cardiology. Its services include revenue cycle management, billing and coding, credentialing, contract management, and EHR implementation consulting. Because SMG operates as a behind-the-scenes administrative partner to physician practices, individuals affected by this breach may be patients of those practices rather than direct SMG customers.
What Happened?
Sierra Management Group was listed in a California Attorney General sample breach notice filed on June 29th, 2026. According to the notice, an unauthorized third party accessed certain SMG systems between December 2025 and March 2026 and may have accessed and copied files containing personal information. SMG completed its review of the affected files on or about June 3rd, 2026. The sample notice uses a template variable for the specific data types involved, so the exact information exposed varies by individual and was not specified in the sample. SMG states it has no evidence of fraud or misuse of the information. The company is offering 12 or 24 months of complimentary credit monitoring and identity restoration services through IDX, with an enrollment deadline of September 29th, 2026.
On March 7th, 2026, a ransomware group known as Genesis posted a claim on the Tor network stating it had attacked Sierra Management Group and stolen 100 GB of data. The group’s dark web posting listed PII, insurance data, healthcare data, financial data, and user folder contents among the allegedly stolen material, and threatened to publish the data if demands were not met. These are threat actor claims and have not been confirmed by SMG. The Genesis group’s public claim predates the June 29th, 2026 breach notice by nearly four months. At least two law firms — Migliaccio & Rathod LLP, which opened a data breach investigation on March 9th, 2026, and The Lyon Firm — are investigating the incident and advising potential victims, though no formal class action lawsuit has been filed as of this writing.
Key Facts at a Glance
- Company or Organization: Sierra Management Group, Inc.
- Industry: Healthcare management services / Medical practice management consulting (MSO)
- Location: Newcastle, California
- Incident type: Unauthorized access; ransomware (threat actor claim)
- Date of breach: December 2025 through March 2026
- Date breach discovered: File review completed on or about June 3rd, 2026
- Date of consumer notification: June 29th, 2026
- Identity theft protection offered: 12 or 24 months of IDX credit monitoring and identity restoration
- Enrollment deadline: September 29th, 2026
- Litigation status: Investigations opened by Migliaccio & Rathod LLP and The Lyon Firm; no class action filed as of this writing
- Source: California Attorney General sample breach notice; ClaimDepot – Genesis ransomware claim; Migliaccio & Rathod LLP investigation; The Lyon Firm
What Should You Do?
If you received a notice from Sierra Management Group, enroll in the complimentary IDX credit monitoring and identity restoration services before the September 29th, 2026 deadline using the enrollment code provided in your letter at app.idx.us or by calling 1-833-788-9712. You should also place a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — and review your account statements and credit reports for any suspicious activity. You are entitled to a free credit report annually from each bureau through AnnualCreditReport.com or by calling 1-877-322-8228. If you believe your information has been misused, visit IdentityTheft.gov for guidance on next steps.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
