Almeida Law Group is investigating a data breach at Columbia Orthopaedic Group. If you were affected, contact Almeida Law Group.
About Columbia Orthopaedic Group
Columbia Orthopaedic Group is a healthcare provider based in Columbia, Missouri, specializing in orthopedic care, sports medicine, joint replacement, and musculoskeletal rehabilitation. Founded in 1965, the practice includes more than 27 board-certified physicians across nine sub-specialties and operates an on-site ambulatory surgical center. Because it provides medical care, the information it collects from patients is sensitive in nature.
What Happened?
Columbia Orthopaedic Group was listed in an HHS Office for Civil Rights breach portal report submitted on June 18th, 2026, identifying a hacking and IT incident affecting a network server. The filing lists 500 individuals affected, though that figure is frequently used as a placeholder before a final count is determined, and the true scope of the incident may be larger. The specific data types compromised have not been publicly specified by any source; the lawsuits filed against the organization allege that “personal information” and “highly sensitive information” were stolen and posted to the dark web, but no source has enumerated specific data categories.
Multiple sources attribute the attack to LockBit 5, a ransomware-as-a-service group. Comparitech reported on May 25th, 2026 that Columbia Orthopaedic Group experienced a network outage following system issues on approximately April 20th, 2026, with the cause unconfirmed at that time. LockBit’s dark web claim surfaced around May 25th–26th, 2026. Two class action lawsuits have since been filed in Boone County, Missouri. The first was filed on June 16th, 2026 by plaintiff Vicki Dixon, and the second on June 23rd, 2026 by plaintiff Geraldine Mize. Both allege negligence, breach of implied contract, unjust enrichment, violations of the Missouri Merchandising Practices Act, and failure to encrypt or redact highly sensitive patient information. As of the most recent reporting, Columbia Orthopaedic Group had not publicly confirmed the breach.
Key Facts at a Glance
- Company or Organization: Columbia Orthopaedic Group
- Industry: Healthcare Provider – Orthopedic Medicine and Surgery
- Location: 1 South Keene Street, Columbia, Missouri 65201
- Incident type: Hacking/IT Incident (ransomware – LockBit 5)
- Date breach discovered: May 26th, 2026
- Date of consumer notification: June 18th, 2026 (HHS OCR breach portal submission date)
- Total persons affected: 500 (likely a placeholder; final count may be higher)
- Litigation status: Two class action lawsuits filed in Boone County, Missouri (June 16th, 2026 and June 23rd, 2026); separate attorney investigation underway
- Source: HHS Office for Civil Rights breach portal report; Breachsense; ABC17 News – First lawsuit; ABC17 News – Second lawsuit
What Should You Do?
If you believe you may have been affected by this incident, consider placing a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — and monitoring your accounts and credit reports closely for any unusual activity. You can request free annual credit reports at AnnualCreditReport.com. Because this incident involved a healthcare provider, you should also review your Explanation of Benefits statements and request copies of your medical records to check for any services you did not receive or accounts you do not recognize. If you identify signs of fraud or identity theft, visit IdentityTheft.gov for step-by-step guidance on how to respond.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
