Altos Data Breach: 6,414 Patients, No Lawsuit Found
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Altos, Inc. is a Southern California billing company that works behind the scenes for doctors' offices — so you may have heard its name for the first time in a breach letter. An internal system holding names, Social Security numbers and health information was left exposed to the internet in 2025, and an outsider got in. As of October 2026 we found no Calif. medical billing company Altos data breach lawsuit on file: no settlement, no fund and no claim form.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened at Altos
Altos describes itself as a billing services provider for many healthcare providers in southern California; trade press adds medical transcription and practice-management work. That is why it held patient records from practices you actually visited.
The report filed with the California Attorney General lists the breach dates as May 30–31, 2025. According to the company's notice letter, Altos became aware on June 17, 2025 that one of its internal systems containing personal and health information was exposed to the internet. It blocked access and hired a cybersecurity firm, which found that an unauthorized third party had been in the system and may have removed data. The investigation concluded on July 21, 2025.
HIPAA Journal described the cause as a system “accidentally exposed to the Internet” — an accidental exposure, not a reported ransomware attack.
Case Details
No lawsuit found. As of October 13, 2026, a search of the CourtListener federal RECAP archive for “Altos” and “data breach” returned 31 results, none naming Altos as a party, and our database of federal district-court filings shows no case against Altos, Inc. That is a statement about what we could find, not proof that nothing exists: California state-court dockets are not searchable in the same way.
On August 4, 2025 ClassAction.org published a notice that attorneys were “investigating” the breach. An investigation announcement is a request for clients. It is not a complaint, it has no case number and it does not make anyone a class member.
Status: Breach Reported, No Case Filed
Were You Affected?
HIPAA Journal reported that the exposed system held the protected health information of 6,414 individuals. The California Attorney General listing does not state a number.
The practical test is your mail. Affected people were sent a letter from “Secure Processing Center, P.O. Box 3826, Suwanee, GA 30024” signed on behalf of Altos. It explains that Altos is a billing provider for healthcare practices, lists the exposed fields and contains a personal activation code and enrollment deadline for credit monitoring. Keep the letter and the envelope.
If you did not get a letter, being a patient somewhere in Southern California does not by itself mean your record was in this system. You can ask the Altos response line at 877-250-2835 (Monday–Friday, 6 am to 6 pm Pacific).
Is There Money?
California law sets one benchmark: under the California Consumer Privacy Act, a person whose nonencrypted, nonredacted data was stolen because a business failed to keep reasonable security can sue for actual damages or statutory damages of up to $750 per incident, after giving the business 30 days' written notice. That is a statutory ceiling, not an offer from Altos. Comparable healthcare-breach settlements are summarized in our data breach settlement calculator.
Altos Breach Timeline
- 1
May 30–31, 2025 — The Breach Window
These are the dates of breach Altos gave the California Attorney General.
- 2
June 17, 2025 — Altos Learns of the Exposure
Altos finds an internal system with personal and health information exposed to the internet, blocks access and brings in a cybersecurity firm.
- 3
July 21, 2025 — Investigation Concludes
The firm finds an unauthorized third party was in the system and may have removed data: names, addresses, birth dates, Social Security numbers, health information.
- 4
August 1, 2025 — Reported to California
Altos files its breach report and sample notice letter with the California Attorney General. A ClassAction.org attorney “investigation” notice follows on August 4.
- 5
September 2025 — 6,414 People Named
HIPAA Journal reports on September 10, 2025 that the exposed system held the health information of 6,414 individuals.
- 6
October 2026 — Still No Lawsuit Found
As of October 13, 2026 we found no federal lawsuit, settlement or claim process tied to the Altos breach.
Three Things to Watch For
A breach with letters in the mail but no lawsuit is the gap that imposters and ad funnels fill:
“Claim your Altos settlement” pages
There is no Altos settlement, so there is no claim form and no payment to “secure.” A page asking for your Social Security number to file one is collecting data from people whose Social Security numbers were just exposed.
Calls posing as the Altos response line
The real numbers are printed on your letter: 877-250-2835 for Altos and 866.675.2006 for Epiq enrollment help. Real enrollment happens at privacysolutionsid.com with the activation code in your letter. If someone calls you first and asks for your full SSN or a fee, hang up and dial the number on the letter.
“Sign up to join the Altos class action”
No Altos class action has been located. A sign-up form is an attorney intake form, and a retainer is a contract with consequences. Also beware of name confusion: Los Altos Food Products is a separate, unrelated company on the same California breach list.
Altos Data Breach — Questions People Actually Ask
Who is Altos, and why did it have my information?
Altos, Inc. is a billing services provider for healthcare practices in Southern California, also described as doing medical transcription and practice management. If your doctor's office used Altos, your records passed through its systems even though you never dealt with the company directly.
Is there a Calif. medical billing company Altos data breach lawsuit?
As of October 13, 2026 we found none. A CourtListener search of federal filings returned 31 hits for “Altos” and “data breach,” none against Altos, and our federal filings database shows no case. ClassAction.org published an attorney investigation notice on August 4, 2025, which is not the same as a filed case. State courts are harder to search, so a state-court suit cannot be fully ruled out.
How many people were affected, and what data was exposed?
6,414 individuals, according to HIPAA Journal. The notice letter lists name, address, date of birth, Social Security number and health information. Altos said it was not aware of any identity fraud resulting from the incident.
Is the Altos breach letter real?
The sample letter filed with the California Attorney General comes from “Secure Processing Center, P.O. Box 3826, Suwanee, GA 30024,” gives the response line 877-250-2835 and directs you to privacysolutionsid.com with an activation code. A letter matching those details is consistent with the official notice. When in doubt, call the number on the Attorney General's copy, not one given to you by a caller.
Can you sue a company over a data breach?
Yes, in limited cases. In California, the Consumer Privacy Act lets you sue if your nonencrypted, nonredacted personal information was stolen because the business did not maintain reasonable security, for actual damages or up to $750 per incident, after 30 days' written notice. Negligence and other claims are pleaded in most breach class actions; whether any of that fits your situation is a question for a licensed attorney.
Is there a class action lawsuit against Change Healthcare for data breach?
That is a different company and a different breach; this page does not cover it. Our Change Healthcare data breach page tracks those cases, and the AMCA page covers an older billing-collections breach.
Should I sign up for the free credit monitoring?
It costs nothing and is offered whether or not anyone ever sues. Use the activation code and enrollment deadline printed in your letter; the confirmation email comes from noreply@privacysolutions.com. Enrolling does not waive any rights.
What is worth doing right now?
Freeze your credit at Equifax, Experian and TransUnion — it is free and you can lift it. A fraud alert is an alternative: an initial alert lasts at least 90 days, an extended one seven years. Because health information was involved, read your insurer's explanation-of-benefits statements for care you never received. Keep the notice letter.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Data Breach Settlement Calculator
What comparable breach settlements have paid per person
Open Class Action Settlements
Settlements currently accepting claims, with deadlines
TriZetto Data Breach
Another healthcare billing vendor breach, now a federal MDL
Change Healthcare Data Breach
The largest healthcare payment-system breach and its lawsuits