Orthopaedic Institute of Western Kentucky Data Breach
Last Updated on June 26, 2026
At A Glance
- What's Going On?
- Attorneys need to hear from people affected by the Orthopaedic Institute of Western Kentucky data breach as they investigate whether a class action lawsuit can be filed.
- Does This Cost Anything?
- It costs nothing to get in touch or to talk to someone about your rights.
- What Can I Get?
- If filed and successful, a class action lawsuit could provide consumers with money for any harm resulting from the Orthopaedic Institute of Western Kentucky breach.
Orthopaedic Institute of Western Kentucky Data Breach: Lawsuit Investigation
Attorneys working with ClassAction.org are looking into whether a class action lawsuit can be filed in light of the Orthopaedic Institute of Western Kentucky data breach.
As part of their investigation, they need to hear from individuals who had their information exposed in the incident, including those who received notice of the Orthopaedic Institute of Western Kentucky data breach or otherwise believe they are affected.
Orthopaedic Institute of Western Kentucky Security Incident: What Happened?
The Orthopaedic Institute of Western Kentucky, which was acquired by Mercy Health in December 2023 and now operates as Mercy Health – Western Kentucky Orthopedics, reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation (OCABR).
According to a sample notice provided to OCABR (pictured below), the breach occurred at a third-party vendor, Keystone Technologies, which provided managed services for the Orthopaedic Institute of Western Kentucky. Keystone Technologies experienced two cybersecurity incidents in mid-2025, during which unauthorized parties accessed certain systems and obtained files.
An investigation into the Orthopaedic Institute of Western Kentucky data breach found that patient information, including names, Social Security numbers, birth dates, addresses, medical record numbers, health insurance details, and treatment information, had been compromised. The Orthopaedic Institute of Western Kentucky's electronic medical record system and Mercy Health's IT and electronic medical record systems were not involved or affected by the breach.
What You Can Do After the Orthopaedic Institute of Western Kentucky Data Breach
If your information was exposed in the Orthopaedic Institute of Western Kentucky data breach, attorneys want to hear from you. You may be able to start a class action lawsuit to recover compensation for loss of privacy, time spent dealing with the breach, out-of-pocket costs, and more.
A successful case could also force Orthopaedic Institute of Western Kentucky to ensure they take proper steps to protect the information they were entrusted with.
Orthopaedic Institute of Western Kentucky Data Breach Notice
Published: March 5, 2026
Before commenting, please review our comment policy.
Featured In:
Who Is ClassAction.org?
ClassAction.org is a group of online professionals who are committed to exposing corporate wrongdoing and giving consumers the tools they need to fight back.
We've been reporting on the legal space for nearly a decade and have built relationships with class action and mass tort attorneys across the country.
