Ambulance service breached – now hackers might know your blood type and bank info

A massive cyberattack on a Midwestern ambulance company may have exposed everything from medical records to passport numbers for over 100,000 patients.

If you called an ambulance in Illinois last year, there’s a non-zero chance that a hacker now knows more about you than your doctor does.

Medical Express Ambulance (MedEx), one of Illinois’ largest private ambulance services, was hit with a cyberattack that compromised the personal, medical, and financial data of 118,418 people.

The breach, which occurred in 2024, was only recently made public through a filing with the Maine Attorney General's office after an investigation was finished.

The company says it discovered “a network disruption” on March 18th, which immediately triggered a shutdown of its systems. In response, MedEx brought in a third-party cybersecurity team and locked down its network while forensics teams tried to figure out just how deep the rabbit hole went.

According to the investigation, the stolen data could include

• Full names
• Birth dates
• Social Security numbers
• Driver's license numbers
• Medical and insurance information
• Login credentials
• For some people – passport details

So far, the company claims it has seen no signs of the stolen data being misused. To its credit, MedEx is offering victims 12 months of free credit monitoring and identity theft protection.

MedEx, which operates out of Skokie, Illinois, runs a fleet of over 80 ambulances and employs more than 375 people.

Healthcare and emergency services have become a favorite target for cybercriminals, largely because the sector still treats IT security like an optional upgrade instead of a life-or-death priority.

Just this year, UnitedHealth Group, one of the biggest health insurance giants in the US, admitted that a jaw-dropping 100 million Americans had their data compromised in a breach. That’s nearly one in three people in the country.

Last year, a ransomware attack in London brought entire hospitals to their knees – shutting down services, rerouting ambulances, and forcing staff to cancel critical treatments.

Regional Care (RCI) had to notify nearly a quarter of a million patients after hackers busted into their system. Ascension Health, one of the largest healthcare networks in the country, also reported a breach that affected 5.6 million people