Almeida Law Group is investigating a data breach at Village Practice Management Company, LLC. The breach occurred on December 2nd–18th, 2025 and was discovered on July 1st, 2026. If you were affected, contact Almeida Law Group.
About Village Practice Management Company, LLC
Village Practice Management Company, LLC does business as VillageMD, a healthcare company founded in 2013 and headquartered in Chicago, Illinois. The company provides management services to healthcare providers, including tools, technology, operations, and staffing support for care delivery. Its operating brands — Village Medical, Village Medical at Home, Summit Health, and CityMD — serve millions of patients across approximately 700 practice locations in 26 markets. Walgreens Boots Alliance made a $5.2 billion investment in the company in October 2021. Because VillageMD operates as a medical provider management platform, it handles sensitive patient information including names, Social Security numbers, medical records, and dates of birth — the precise data types compromised in this breach.
What Happened?
Village Practice Management Company, LLC was listed in a Texas Attorney General data security breach report (record BR-0005222, published August 4th, 2026). According to that filing, an unauthorized party gained access to company systems between December 2nd, 2025 and December 18th, 2025. The breach was not discovered until July 1st, 2026 — roughly 195 days after unauthorized access ended. The compromised information includes names, Social Security numbers, medical information, and dates of birth. A total of 250,821 individuals were affected, and consumers were notified by U.S. Mail.
No independent media coverage, HHS Office for Civil Rights breach portal entries, or ransomware group claims connected to this specific incident were found in publicly available sources as of August 4th, 2026. It is worth noting that in 2024, VillageMD faced a separate class action lawsuit alleging its website used Meta Pixel tracking technology to share patients’ protected health information with third parties including Facebook and Google without consent. That lawsuit, filed in U.S. District Court for the Northern District of Illinois, is unrelated to this December 2025 breach. No litigation specifically tied to this incident has been identified.
Key Facts at a Glance
- Company or Organization: Village Practice Management Company, LLC (d/b/a VillageMD)
- Industry: Healthcare – Medical Provider / Practice Management
- Location: Chicago, Illinois 60607
- Incident type: Unauthorized access to systems
- Date of breach: December 2nd, 2025 – December 18th, 2025
- Date breach discovered: July 1st, 2026
- Date of consumer notification: August 4th, 2026 (date published at OAG website)
- Total persons affected: 250,821
- Notification method: U.S. Mail
- Prior breach: 2024 Meta Pixel class action lawsuit (separate privacy matter; not a traditional system intrusion)
- Litigation status: No litigation specifically connected to this December 2025 breach found as of August 4th, 2026
- Source: Texas Attorney General Data Security Breach Report BR-0005222 (https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005222); Healthcare Dive – VillageMD faces lawsuit over online tracking technologies (https://www.healthcaredive.com/news/villagemd-online-tracking-technology-lawsuit-meta-pixel/713016/)
What Should You Do?
If you received a notice from Village Practice Management Company, LLC or believe you may be affected, take action promptly. Enroll in any identity theft protection services offered in the notification letter and note any enrollment deadline. Because Social Security numbers, medical information, and dates of birth were exposed, your risk of identity theft and medical fraud is elevated. Place a fraud alert or credit freeze with all three major credit bureaus — Equifax, Experian, and TransUnion — and monitor your credit reports closely. You can request free reports at AnnualCreditReport.com. Review your Explanation of Benefits statements and medical records for any services you did not receive, as exposed medical information can be used to fraudulently bill insurers or obtain care in your name. If you discover signs of fraud or identity theft, report them at IdentityTheft.gov for step-by-step recovery guidance.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
