A four-day intrusion at a 33-location dermatology and plastic surgery group in central Florida has landed on the federal breach rolls at 85,585 people. Mid Florida Dermatology & Plastic Surgery told the HHS Office for Civil Rights that an unauthorized party sat inside its network from March 26 to March 30, 2026, after staff flagged unusual activity. A later review of the files found names, addresses, birth dates, passport and Social Security numbers, driver’s license numbers, Medicare and other government identifiers, financial account data, and medical and health insurance details.
The same disclosure round brought two smaller filings. Kannarr Eye Care, an optometry practice in Pittsburg, Kansas, reported 14,003 people after an intruder reached files holding names, Social Security numbers, and insurance data; letters went out September 17. Indiana University Health’s affiliated covered entity reported 2,080 patients after a vulnerability in a system run by vendor AME Group exposed imaging center information for patients in southern Indiana. IU Health said its core systems and electronic medical records were untouched.
For hospital and clinic security leaders, the pattern is familiar. Two of the three incidents ran through systems the covered entity did not fully control, and none involved a headline-grabbing ransomware shutdown. The Mid Florida group took four days to detect and contain, a window long enough for an intruder to sweep file shares and mail stores.
Practical response: shorten dwell time with file-access monitoring rather than relying on endpoint alerts alone, and audit vendor-managed systems for unpatched vulnerabilities before a breach notice forces the review.
