Almeida Law Group is investigating a data breach at BASS Medical Group. The breach occurred on September 4th, 2026. If you were affected, contact Almeida Law Group.
About BASS Medical Group
BASS Medical Group is a large, independent, physician-led multi-specialty medical group headquartered in Walnut Creek, California. It operates more than 200 locations across the San Francisco Bay Area and Central Valley, with over 300 providers spanning 42 specialties that include primary care, OB-GYN, orthopedic surgery, neurology, urology, cancer care, and imaging services. Because BASS provides direct patient care across a wide range of specialties, it maintains medical treatment, billing, and health insurance records for a large number of patients—making it a significant holder of protected health information.
What Happened?
BASS Medical Group was listed in a California Attorney General sample breach notice reported on October 22nd, 2026. According to the notice, BASS discovered suspicious activity within its network environment on or around September 4th, 2026. The organization immediately secured its network and retained independent cybersecurity experts to investigate. By approximately September 22nd, 2026, the investigation confirmed that certain personal and protected health information may have been accessed or acquired without authorization. The specific data types identified in the breach notice are medical treatment codes or billing information and health insurance information. The total number of affected individuals has not been disclosed. BASS notified the California Attorney General, the FBI, and the U.S. Department of Health and Human Services Office for Civil Rights. As of the time of reporting, BASS stated it had no evidence of misuse or attempted misuse of the exposed information. No ransomware group has publicly claimed responsibility for this incident.
BASS Medical Group has a prior breach history. On April 9th, 2021, an unauthorized individual broke into a BASS office and stole papers containing scheduled appointment information and related protected health information for a limited number of patients. That stolen data may have included names, addresses, dates of birth, phone numbers, and prescription, diagnosis, and treatment information. Law enforcement recovered the papers from a suspect. No class action lawsuit connected to the October 2026 breach has been filed as of this writing, though the incident has been listed on breach tracking resources indicating that law firms may be investigating.
Key Facts at a Glance
- Company or Organization: BASS Medical Group
- Industry: Healthcare / Multi-Specialty Medical Group
- Location: Walnut Creek, California
- Incident type: Unauthorized access to network environment
- Date of breach: September 4th, 2026
- Date breach discovered: September 4th, 2026
- Date of consumer notification: October 22nd, 2026
- Prior breach: April 9th, 2021 physical break-in and theft of patient records
- Litigation status: No class action filed; law firms reported to be investigating
- Source: California Attorney General sample breach notice; MedSecLedger breach analysis; BASS Medical Group 2021 breach notice
What Should You Do?
If you received a notice from BASS Medical Group, there are several practical steps you can take to protect yourself. Because health insurance information and medical billing codes were involved, review any Explanation of Benefits statements you receive from your insurer for services you do not recognize, and request a copy of your medical records to check for inaccurate entries. Visit AnnualCreditReport.com to obtain free copies of your credit reports from Equifax, Experian, and TransUnion, and monitor them for unfamiliar accounts or inquiries. Consider placing a fraud alert—free and valid for at least one year—with any one of the three major credit bureaus, which will then notify the others. You may also place a free security freeze on your credit file at each bureau to prevent new credit from being opened in your name without your consent. If you notice signs of identity theft, report them at IdentityTheft.gov and notify your financial institutions promptly.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
