This is egregiously bad.

> unauthorized third parties were able to access and steal patients’ private information, including names, dates of birth, Social Security numbers, health insurance policy numbers, Medicaid/Medicare numbers and dental or vision health information, such as provider names, diagnoses, treatments and billing information.