A cyberattack on a Spring-based ambulance company exposed sensitive personal and medical data for more than 14,000 people.
Viking Enterprises, which operates as City Ambulance Service at 7007 Wimbledon Estates Dr. in Spring, reported the hacking incident to the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) on Aug. 31, 2026, according to HIPAA Journal. The company disclosed the breach to the Texas Attorney General's office on Sept. 1, 2026, according to ClassAction.org. Both filings listed 14,324 affected individuals.
The compromised data includes names, addresses, dates of birth, Social Security numbers, medical information and health insurance information, according to the report submitted to the Texas Attorney General.
Who claimed responsibility
A ransomware group called Qilin claimed responsibility for the attack in a July 19 post on a dark web monitoring platform, according to ClassAction.org. HIPAA Journal reported that Qilin's listing stated 14 gigabytes of data had been taken. The stolen data has been published, according to the listing. HIPAA Journal said it had not downloaded any of the data but noted that screenshots uploaded as proof included some patient data.
The HHS OCR report classified the breach as email-related, according to HIPAA Journal. Whether the attack was limited to email systems or involved broader network access remains unclear.
Lawsuits filed in Harris County
Three proposed class action lawsuits have been filed against City Ambulance Service in Harris County court, the Houston Chronicle reported Aug. 4. The plaintiffs include three patients and an employee who accuse the company of failing to protect sensitive personal information before the alleged July cyberattack.
In one lawsuit, a former patient alleges cybercriminals attacked the company's "insufficiently secured network" and that private information "remains in the hands of those cybercriminals," according to the Chronicle.
William Federman, an attorney representing a former patient and employee in one of the lawsuits, told the Chronicle: "Nowadays, an ambulance service has everything your doctor would have, and that's pretty scary."
Federman's lawsuit also alleges City Ambulance Service has yet to notify all people potentially affected by the breach, the Chronicle reported. The plaintiffs argue the breach could have been prevented had the company followed industry-standard cybersecurity practices. As of the Chronicle's Aug. 4 report, the company had not publicly responded to those allegations.
The lawsuits have not yet been certified as class actions. Each asks a judge to determine whether the plaintiffs form a large enough group with similar claims to proceed on behalf of all affected people.
What to know
City Ambulance Service provides ground transport for hospitals, urgent care centers, fire departments and public events across Texas markets including Houston, San Antonio and Dallas, according to ClaimDepot. Officials have urged affected individuals to monitor their accounts and consider protective steps, according to Patch.
