Based on these findings, MedEx decided to proceed with an analysis of the compromised data for any potential sensitive personal information (PII) or protected health information (PHI). MedEx engaged a third-party vendor to review the data that was compromised. The data mining process took some time given the complexities of the types and volume of the data analyzed, requiring multiple phases of automated and manual review. On March 3, 2025, MedEx engaged a third-party notice vendor to assist with the mailings, call center, and provide identity theft protection services for those whose sensitive information was impacted. Thereafter, MedEx worked to verify the patient information and addresses for mailing. On March 19, 2025, MedEx finalized the list of individuals to notify.

The information affected varied for each impacted individual. Based on the investigation, the following information related to potentially impacted individuals may have been subject to unauthorized access: Name; date of birth; demographic information, Social Security number, driver's license number; state identification number; medical information; financial information; health insurance information; username and password; and for some, passport information. Please note that the information above varies for each potentially impacted individual.