The breach took place in 2022 and included sensitive personal information including medical records and "how to ... wait to hear from Advanced Computer Software Group before making a final decision.