Almeida Law Group is investigating a data breach at McEwen and Associates, Inc. The breach occurred on June 23rd–24th, 2025 and was discovered on May 1st, 2026. If you were affected, contact Almeida Law Group.
About McEwen and Associates, Inc.
McEwen and Associates, Inc. is a healthcare support services company based in Irving, Texas that provides medical billing, coding, compliance guidance, and practice management services to medical facilities. The company operates as a business associate serving specialties such as OB/GYN, pediatrics, and cardiology. Because the company handles billing and practice management on behalf of healthcare providers, the personal and medical information of patients—rather than McEwen’s own employees—is central to its work, which is why a breach at this type of company can affect a large number of individuals.
What Happened?
McEwen and Associates, Inc. was listed in a Texas Attorney General data security breach report published on July 23rd, 2026. According to that filing, the breach involved unauthorized access to a network server and occurred over a two-day period on June 23rd and 24th, 2025. The incident was not discovered until May 1st, 2026—approximately ten months after the intrusion. A total of 20,106 individuals were affected. Consumers were notified by U.S. Mail. The compromised information included Social Security numbers, driver’s license numbers, government-issued ID numbers such as passports and state ID cards, financial information such as account and credit or debit card numbers, medical information, and health insurance information.
The same incident was previously reported to the U.S. Department of Health and Human Services on August 21st, 2025, where it was classified as a hacking/IT incident targeting a network server involving protected health information. The HHS filing initially listed at least 500 affected individuals—a figure that has since grown to 20,106 in the Texas Attorney General filing, indicating a significantly expanded scope. The law firm Federman & Sherwood announced in September 2025 that it was investigating the breach for potential consumer privacy litigation; no class action complaint had been filed as of July 2026. No ransomware group claim or specific threat-actor attribution has been identified.
Key Facts at a Glance
- Company or Organization: McEwen and Associates, Inc.
- Industry: Healthcare support services / Medical billing and practice management
- Location: Irving, Texas
- Incident type: Hacking/IT incident targeting a network server
- Date of breach: June 23rd, 2025 – June 24th, 2025
- Date breach discovered: May 1st, 2026
- Date of consumer notification: July 23rd, 2026 (Texas Attorney General report published)
- Total persons affected: 20,106
- Prior breach: Same incident previously reported to HHS on August 21st, 2025, initially listing 500+ affected individuals
- Litigation status: Federman & Sherwood announced an investigation in September 2025; no class action filed as of July 2026
- Source: Texas Attorney General data security breach report (https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005196); ClaimDepot – McEwen & Associates Reports Significant Data Breach (https://www.claimdepot.com/data-breach/mcewen-associates-2025); Federman & Sherwood – McEwen & Associates Data Breach Investigation (https://www.federmanlaw.com/blog/mcewen-associates-data-breach-investigated-by-federman-sherwood/)
What Should You Do?
If you received a notification letter from McEwen and Associates, Inc., review it carefully for any identity protection enrollment offer and note the enrollment deadline. Because this breach involved Social Security numbers, financial account information, medical information, and health insurance information, you should place a fraud alert or credit freeze with all three major credit bureaus—Equifax, Experian, and TransUnion—and monitor your credit reports regularly through AnnualCreditReport.com. Watch your financial accounts for unfamiliar transactions and review your Explanation of Benefits statements from your health insurer and any medical records for services you did not receive. If you discover signs of identity theft, report them at IdentityTheft.gov for a personalized recovery plan.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
