This is very recent and no patients have come forward AFAIK. They'd probably have little cause to draw attention to themselves at this point, although I imagine

This is very recent and no patients have come forward AFAIK. They'd probably have little cause to draw attention to themselves at this point, although I imagine lawsuits are forthcoming if the justice system doesn't handle this in a way that sees serious damages awarded to the patients. Personally, I'd imagine they feel mortified. This pretty much seems like the worst-case scenario for leaked personally identifiable data.