Almeida Law Group is investigating a data breach at Heart Care Centers of Illinois. If you were affected, contact Almeida Law Group.
About Heart Care Centers of Illinois
Heart Care Centers of Illinois (HCCI) is a physician-owned cardiovascular medical group that has served the south and southwest suburbs of Chicago for over 40 years. Headquartered in Palos Park, Illinois, HCCI operates nine clinic locations and employs 26 cardiologists offering services in general cardiology, interventional cardiology, electrophysiology, and vascular surgery. It also operates a Premier Cardiac Surgery Center accredited by the AAAHC. Because HCCI provides direct patient care, it collects and maintains a wide range of sensitive personal, financial, and medical information about its patients.
What Happened?
Heart Care Centers of Illinois was listed in a HHS Office for Civil Rights breach portal report submitted on July 10th, 2026, identifying a hacking/IT incident affecting 52,562 individuals. The breached information was located in email.
According to HCCI’s official breach notice posted July 18th, 2026, the incident began as a phishing attack that gave an unauthorized actor access to an employee’s email account from August 22nd, 2024, to November 6th, 2024. The breach was not discovered until January 15th, 2026, when HCCI was investigating what appeared to be an unsuccessful phishing attempt and uncovered historical suspicious activity in the employee’s account. A third-party forensic investigation confirmed the unauthorized access. A data analytics firm completed its review on June 11th, 2026, determining that certain protected information may have been subject to unauthorized access. Notification letters were mailed to affected individuals starting July 10th, 2026—more than 22 months after the initial unauthorized access began.
Data potentially accessed includes names, mailing addresses, Social Security numbers, dates of birth, driver’s license and state identification numbers, payment card information, financial account information, passport numbers, and medical information such as treatments, conditions, diagnoses, prescription information, health insurance details, and provider data. HCCI is offering complimentary credit monitoring and identity restoration services through Epiq, with an enrollment deadline of October 31st, 2026. Notably, one law firm (Ahdoot & Wolfson) has described the incident as an “alleged ransomware attack,” but HCCI’s own notice and major healthcare trade publications characterize it as a phishing and email compromise incident. Ransomware involvement has not been confirmed by HCCI or any regulator.
A class action lawsuit was filed in Cook County Circuit Court on July 22nd, 2026, by Strauss Borrelli PLLC on behalf of a patient, with a first court date set for September 21st, 2026, in Chicago. Multiple additional law firms, including Wolf Haldenstein, have also announced investigations into potential class action claims related to this breach.
Key Facts at a Glance
- Company or Organization: Heart Care Centers of Illinois
- Industry: Healthcare Provider – Cardiovascular/Cardiology
- Location: Palos Park, Illinois
- Incident type: Hacking/IT Incident (phishing, email compromise)
- Date of breach: August 22nd, 2024
- Date breach discovered: January 15th, 2026
- Date of consumer notification: July 10th, 2026
- Total persons affected: 52,562
- Identity theft protection offered: Complimentary credit monitoring and identity restoration services through Epiq
- Enrollment deadline: October 31st, 2026
- Litigation status: Class action filed July 22nd, 2026, in Cook County Circuit Court; additional law firm investigations announced
- Source: HHS Office for Civil Rights breach portal report; HCCI Official Notice; HIPAA Journal; Becker’s Cardiology; Cardiovascular Business
What Should You Do?
If you received a notification letter from Heart Care Centers of Illinois, enroll in the complimentary credit monitoring and identity restoration services through Epiq before the October 31st, 2026, deadline. You should also place a fraud alert or credit freeze with the three major credit bureaus—Equifax, Experian, and TransUnion—and monitor your financial accounts closely for any unauthorized activity. Request your free credit reports at AnnualCreditReport.com and review them carefully. If you suspect identity theft has already occurred, visit IdentityTheft.gov for step-by-step recovery guidance. Because medical information was involved in this breach, review your Explanation of Benefits statements from your health insurer and check your medical records for any services or charges you do not recognize, which could indicate medical identity theft.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
