Ciox Health, d/b/a Datavant Group data breach

What we know

Ciox Health, operating under the Datavant Group umbrella, occupies a critical and expansive nexus within the modern healthcare ecosystem. As a leading health data company, Datavant facilitates the secure exchange, linkage, and management of vast quantities of protected health information (PHI) and personally identifiable information (PII) on behalf of hundreds of hospitals, health systems, insurance providers, and life sciences organizations. The company's core operations involve processing massive volumes of medical records, billing data, clinical trial information, and patient demographic files to streamline healthcare administration. Because of this central clearinghouse function, Ciox Health and Datavant hold some of the most sensitive, intimate, and valuable personal data in existence, making them prime repositories for highly confidential medical and financial dossiers. In 2025, Ciox Health, d/b/a Datavant Group, reported a significant data security incident to the Nebraska Attorney General, alerting regulators and consumers that unauthorized actors may have breached its digital infrastructure. While the exact vector of the attack remains subject to ongoing forensic investigation, security incidents affecting healthcare data aggregators typically involve sophisticated external intrusions, compromised credential vulnerabilities, or third-party vendor software flaws that bypass perimeter defenses. Given the sprawling architecture required to ingest, harmonize, and transfer medical records across disparate provider networks, any disruption or unauthorized access event can expose vulnerable access points throughout the data pipeline, leaving sensitive corporate and patient-facing databases exposed. The nature of the data entrusted to an organization like Ciox Health means that a successful security breach exposes individuals to severe, multi-faceted risks. Compromised records typically include full names, dates of birth, Social Security numbers, medical record numbers, health insurance policy details, specific diagnosis and treatment histories, and prescription information. Unlike a stolen credit card, which can be readily canceled and replaced, core medical and identity data cannot be altered. The exposure of clinical and demographic information creates immediate dangers of targeted medical identity fraud—where unauthorized parties obtain medical services or prescription drugs using another person's insurance—alongside long-term risks of sophisticated phishing scams, financial account takeover, and fraudulent tax filings. As a handler of massive quantities of protected health information and sensitive consumer data, Ciox Health, d/b/a Datavant Group, is bound by stringent federal and state regulatory frameworks. Under the Health Insurance Portability and Accountability Act (HIPAA), as well as applicable state data protection laws and the Federal Trade Commission Act, the company has an affirmative, legally enforceable obligation to implement robust administrative, physical, and technical safeguards to secure electronic PHI. When a security incident of this magnitude occurs, it often serves as strong prima facie evidence that the organization failed to maintain adequate encryption standards, robust multi-factor authentication, or timely vulnerability patching, thereby breaching its legal duty of care to the millions of individuals whose data it commercializes and manages. Receiving an official data breach notification letter from Ciox Health, d/b/a Datavant Group, is a formal legal admission that your confidential information was compromised due to corporate security shortcomings. This notification establishes the legal standing necessary to participate in a class action lawsuit aimed at holding the company accountable for its failure to protect your privacy. Under the law, affected individuals do not need to demonstrate that they have already suffered actual financial loss or medical fraud to seek legal redress; the mere exposure of your sensitive data constitutes a compensable injury. Our firm is currently investigating potential class action claims on a strict contingency fee basis, meaning there are never any out-of-pocket costs or attorney fees unless we successfully recover compensation on your behalf.

See every breach reported in Nebraska or read what to do after a ransomware attack.