Catalyst Physician Group Data Breach Affects California Patients

Catalyst Physician Group, a prominent outpatient medical network operating in California, recently reported a data security incident. The breach, which occurred on December 2, 2025, involved unauthorized access to the group's internal digital environment, leading to the exposure of highly confidential patient data. This incident was formally reported to authorities on September 11, 2026, and is currently under monitoring.

The compromised patient records included sensitive categories such as Full Name, Date of Birth, Social Security Number, Medical Record Number, Health Insurance ID Number, Diagnosis and Treatment Information, Prescription Information, Provider and Treatment Dates, and Billing and Financial Information. Such comprehensive exposure of personal and medical details can have severe and lasting consequences for individuals.

Unlike a compromised credit card, which can be canceled and replaced, core medical and identity data cannot be changed. The exposure of clinical and diagnostic information can open affected individuals to medical fraud, where criminals might use stolen identities to obtain healthcare services or bill insurance providers fraudulently. Furthermore, the combination of Social Security Numbers and Dates of Birth creates a high risk for full identity theft, fraudulent loan applications, and financial account takeovers.

Under both federal and California state privacy laws, including HIPAA, the California Confidentiality of Medical Information Act (CMIA), and the California Consumer Privacy Act (CCPA), healthcare providers like Catalyst Physician Group have a clear legal obligation to implement robust security measures to protect patient data. A breach of this magnitude suggests that the organization may have failed to uphold these essential safeguards, leaving patient information vulnerable to malicious actors.

If you received a data breach notification letter from Catalyst Physician Group, it serves as formal acknowledgment that your private information was compromised due to inadequate data security. The mere exposure of such sensitive data can constitute a compensable injury under California law, meaning you may have legal standing even if you haven't yet experienced direct financial loss. Our team is currently investigating potential class action claims on behalf of impacted patients, and we offer free case reviews with representation on a contingency fee basis, so you pay nothing out of pocket unless we successfully recover compensation for you.