INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Mid Florida Dermatology & Plastic Surgery Data Breach Exposes 85K

| 2026-10-16 15:29 CRITICAL HIGH DATA BREACH
JSON
Executive Summary
AI-generated
A data breach was reported by Mid Florida Dermatology & Plastic Surgery on October 16, 2026, affecting 85,585 individuals. The entity behind the attack is unknown at this time. Unusual activity was identified within its computer systems on March 30, 2026, and an unauthorized third party had access to its network from March 26, 2026, to March 30, 2026. This breach involved viewing or acquiring files containing patient data, including names, addresses, dates of birth, passport numbers, Social Security numbers, driver’s license numbers, Medicare numbers, other government identification numbers, financial account numbers, and medical information. The current status is that Mid Florida Dermatology & Plastic Surgery has notified the HHS’ Office for Civil Rights about the breach and is reviewing its security policies and procedures to reduce the risk of similar incidents in the future.
Technical Mitigations AI-generated
• Patch AME Group's external vendor-managed system to address the previously unknown security vulnerability. • Review and enhance security measures, implement additional technical safeguards, and strengthen policies related to data privacy and security for Kannarr Eye Care. • Conduct a forensic investigation to determine unauthorized access points and implement countermeasures to prevent similar incidents in Mid Florida Dermatology & Plastic Surgery.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope healthhealth
Incident Timeline
‎March 26, 2026
An unauthorized third party accessed the network of Mid Florida Dermatology & Plastic Surgery from March 26, 2026, to March 30, 2026.
industry Health
General Document Context
‎March 30, 2026
An unauthorized third party accessed or acquired files containing patients' personal and protected health information from March 26, 2026, to March 30, 2026.
industry Health
General Document Context
organisation Social Security
The data review determined that the information potentially accessed or obtained included names, addresses, dates of birth, passport numbers, Social Security numbers, driver’s license numbers, Medicare numbers, other government identification numbers, financial account numbers, financial account access information, health insurance information, and medical information.
organisation Medicare
The data review determined that the information potentially accessed or obtained included names, addresses, dates of birth, passport numbers, Social Security numbers, driver’s license numbers, Medicare numbers, other government identification numbers, financial account numbers, financial account access information, health insurance information, and medical information.
‎August 4, 2026
Threat actors exploited a previously unknown security vulnerability to gain unauthorized access to limited imaging center information related to patients in Southern Indiana.
industry Health
General Document Context
organisation AME
Steps were immediately taken to verify the security of its systems, and while it was established that its core systems and electronic medical records were unaffected, a review of AME’s external vendor-managed system confirmed that there had been unauthorized access to limited imaging center information related to patients in Southern Indiana.
‎August 17, 2026
Threat actors used unauthorized access to breach mid Florida Dermatology & Plastic Surgery's systems, resulting in the exposure of sensitive patient data.
industry Health
General Document Context
‎September 10, 2026
According to a September 10, 2026, notice on the medical group’s website, unusual activity was identified within its computer systems on March 30, 2026.
industry Health
General Document Context
‎September 17, 2026
The data breach was reported to the HHS’ Office for Civil Rights as affecting 14,003 individuals.
industry Health
General Document Context
organisation the HHS’ Office for Civil Rights
The data breach was reported to the HHS’ Office for Civil Rights as affecting 14,003 individuals.
organisation Indiana University Health
Indiana University Health, Affiliated Covered Entity Indiana University Health Affiliated Covered Entity, has disclosed a security incident that has affected 2,080 individuals.
organisation AME Group
The incident involved one of its vendors, AME Group.
organisation IU Health
AME Group provides information technology services for an isolated IU Health legacy system.
‎September 29, 2026
The affected individuals were notified on September 29, 2026.
industry Health
General Document Context
‎Oct 16, 2026
Mid Florida Dermatology & Plastic Surgery notified the HHS' Office for Civil Rights about a data breach affecting 85,585 individuals.
industry Health
General Document Context
tactic Data Breach
Mid Florida Dermatology & Plastic Surgery Data Breach Affects 85K Patients Posted By Steve Alder on Oct 16, 2026
general_metric 85 Patients
Mid Florida Dermatology & Plastic Surgery Data Breach Affects 85K Patients Posted By Steve Alder on Oct 16, 2026
organisation K Patients Posted
Mid Florida Dermatology & Plastic Surgery Data Breach Affects 85K Patients Posted By Steve Alder on Oct 16, 2026
organisation HHS’ Office for Civil Rights
Mid Florida Dermatology & Plastic Surgery Mid Florida Dermatology & Plastic Surgery, a medical group with 33 locations in central Florida, has notified the HHS’ Office for Civil Rights about a data breach affecting 85,585 individuals.
organisation Mid Florida Dermatology & Plastic Surgery
Data breaches have been announced by Mid Florida Dermatology & Plastic Surgery, Kannarr Eye Care in Kansas, and Indiana University Health Affiliated Covered Entity.
organisation Kannarr Eye Care
Data breaches have been announced by Mid Florida Dermatology & Plastic Surgery, Kannarr Eye Care in Kansas, and Indiana University Health Affiliated Covered Entity.
Intelligence Sources
HIPAA Journal 2026-10-16