Exo Data Breach Investigation

A third-party cybersecurity monitoring service recently reported that Exo, a California-based medical technology company specializing in point-of-care ultrasound imaging, appeared on a ransomware leak site associated with the SETTRA group. Contact our data breach attorneys to learn more.

The listing, which surfaced around mid-October 2026, claimed that attackers had obtained roughly 950 gigabytes of data. Descriptions circulating with the claim referenced patient names, internal employee identifiers, clinical diagnoses, device serial numbers, and certain banking details.

Exo has not confirmed any of these assertions. As of this writing, the company has issued no public statement acknowledging a breach, describing the scope of any intrusion, or verifying that sensitive information was taken. The absence of official confirmation is important. Ransomware groups routinely post unverified claims to pressure targets or attract attention. Without corroboration from the company, regulators, or independent forensic reporting, the hacking listing remains an allegation rather than an established fact.

Patients, employees, and business partners should treat the report as a caution rather than settled news. That said, the potential sensitivity of the data described raises legitimate concerns for individuals whose information may have been stored on Exo’s systems.

California’s data-breach notification laws require companies that experience a qualifying incident involving residents’ personal information to provide timely notice. Until Exo or a regulatory filing confirms the event and outlines what, if anything, was exposed, affected individuals have no formal avenue for assessing personal risk.

In the meantime, standard precautions remain prudent: monitor financial and medical accounts for unusual activity, place fraud alerts if warranted, and be alert to phishing attempts that reference medical or imaging services.

Data-breach claims of this kind often evolve quickly. Additional details may emerge through company disclosures or state attorney-general filings. Anyone who believes their information could have been involved should consider consulting counsel familiar with California privacy statutes and class-action practice.

If you have received a notice or have reason to believe your personal or medical data may have been compromised in connection with this reported incident, contact The Lyon Firm for a free, confidential consultation. Experienced data-privacy attorneys can help you understand your rights and options under California law.