Endue Software enduesoftware.com Endue Software data breach: what happened and what to do
Endue Software, which makes infusion center management software, reported a cyberattack with access on February 16, 2025. It told HHS 118,028 people were affected. Names, addresses, birth dates, Social Security numbers and medical record numbers may be exposed.
View all 13,115 breaches- Breach date
- 16 Feb 2025
- Made public
- 11 Apr 2025
- Affected
- 118,028
- Data exposed
- Names, Physical addresses, Dates of birth, Social security numbers, Medical record numbers
- Last updated
What happened
Endue Software makes software that infusion centers use to manage orders, scheduling and medication. In April 2025 it confirmed a cyberattack. Its investigation found an intruder accessed its systems on February 16, 2025, and suspicious activity was detected the next day. The company's notice is dated April 11, 2025.
Endue reported the breach to the U.S. Department of Health and Human Services as affecting 118,028 people. The real total may be higher: some of Endue's healthcare clients filed their own notifications. Rheumatology Associates of Baltimore, for example, reported 28,968 patients.
What was exposed
The data may include names, addresses, dates of birth, Social Security numbers and medical record numbers. You may not have heard of Endue: it holds data on behalf of your doctor's office or infusion center.
What it means for you
A name, birth date and Social Security number together are enough to open credit in your name. Medical record numbers can feed medical identity fraud and convincing scams that pose as your provider.
The company's response
Endue offered 12 months of identity theft protection through TransUnion to affected people and sent notification letters. It faces proposed class action lawsuits over the incident.
What to do if you were in it
- 1
Freeze your credit
A freeze at Equifax, Experian and TransUnion stops anyone opening new credit in your name. It's free, takes a few minutes per bureau and you can lift it when you need to borrow.
- 2
Take the free monitoring if you were offered it
If Endue or your provider sent you a letter with an enrollment code, use it before the deadline. It adds alerts on top of a freeze, it doesn't replace one.
- 3
Read your statements and explanations of benefits
Look for accounts, loans, claims or tax filings you don't recognize, and report them to the lender, insurer or the IRS right away.
- 4
Expect phishing that mentions the breach
Scammers pose as Endue or your provider or as a credit monitoring service. Don't click links in unexpected texts or emails, and call the number on the letter or the official website instead.
- 5
Check whether your email or phone is in this and other breaches
A free Serus scan shows where your email address and phone number have appeared in known breaches and tells you what to do next.
Frequently asked
Was I affected?
If you were treated at a clinic that uses Endue, you may have received a letter from Endue or from your provider. Contact your provider if you're unsure.
What was exposed?
Possibly names, addresses, dates of birth, Social Security numbers and medical record numbers.
How many people were affected?
Endue reported 118,028 people to HHS. Some clients filed separate notifications, so the total may be higher.
Should I change my password?
The notice doesn't say passwords were involved. Freeze your credit and watch your medical statements.
Sources
- hipaajournal.com/endue-software-confirms-data-breach-affecting-multiple-providers/
- teiss.co.uk/news/cyberattack-at-endue-software-exposes-personal-and-health-data-of-over-118000-individuals-15739
- bankinfosecurity.com/hack-on-infusion-center-software-supplier-affects-118000-a-28287
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- oag.ca.gov/privacy/databreach/list
Something wrong or out of date? Tell us and we'll re-check it.
