Central Texas Pediatric Orthopedics Data Breach

NOTICE: If you received a NOTICE OF DATA BREACH letter from Central Texas Pediatric Orthopedics, contact the Arnold Law Firm at (916) 777-7777 to discuss your legal options, or submit a confidential Case Evaluation form here.

​​​​​​​​​​​On April 14, 2025, Central Texas Pediatric Orthopedics (“CTPO”) reported a significant cybersecurity incident to the Maine Attorney General’s Office. The incident, which occurred between January 23 and January 26, 2025, involved unauthorized access to CTPO’s computer systems (the “Data Breach”). Upon detecting the breach, CTPO initiated an investigation with the assistance of third-party cybersecurity specialists. The investigation determined that an unauthorized third party, identified as the Qilin ransomware group, accessed and potentially exfiltrated sensitive personal and protected health information. Approximately 140,000 individuals have been impacted.

Recently, CTPO began sending data breach notification letters to individuals affected by the Data Breach. These letters include information about the incident and steps individuals can take to protect their personal information. As of now, CTPO has not disclosed any further information about the Data Breach. If you received a data breach notification letter from CTPO, it indicates that your information was affected by the Data Breach.

Established in 1990, CTPO is a specialized medical practice headquartered in Austin, Texas, providing orthopedic care for children from birth through adolescence. The practice offers comprehensive treatment for musculoskeletal conditions, including fractures, scoliosis, sports injuries, and congenital disorders. CTPO operates multiple office locations in the Austin area, providing full-service outpatient clinics equipped with X-rays, casting services, and physical and occupational therapy. The organization employs approximately 66 individuals and generates an estimated $7 million in annual revenue.

WHAT INFORMATION IS INVOLVED?

As of now, Western Wayne Physicians has not disclosed any further information about the Data Breach. We will continue to monitor the situation for updates. The types of information compromised are not clear at the moment but may potentially include the following:

• Full names,
• Dates of birth,
• X-ray images.

This information is called your Personally Identifiable Information (“PII”). It tells others about you and is considered part of your identity. Businesses are required to secure this information or risk facing statutory penalties, among other legal penalties. Stolen PII can be used by identity thieves to engage in fraudulent activity using your identity.

Personal medical information (a specific type of PII) is referred to as Protected Health Information (“PHI”). It is protected under both state and federal law. Healthcare providers and other businesses who handle PHI are required to protect that information. Like stolen PII, stolen PHI can be used by identity thieves to engage in fraudulent activity using your identity. Quite often, PII and PHI are used in conjunction by hackers.

The best way to protect yourself after a data breach is to sign up for credit and identity protection services as soon as possible.

California offers extra protections and legal rights to its residents through the California Consumer Privacy Act (“CCPA”).

NOTICE: If you received a NOTICE OF DATA BREACH letter from Central Texas Pediatric Orthopedics, contact the Arnold Law Firm at (916) 777-7777 to discuss your legal options, or submit a confidential Case Evaluation form here.