Loading story…
Brown Health Medical Group-MA disclosed a data breach affecting 311,760 individuals after unauthorized activity was discovered on a legacy file server at its Hawthorn location in December 2025. The organization said the intrusion was limited to that historic file server and did not affect its electronic medical record or electronic health record systems, but a June 22, 2026 review found that files on the server had been accessed.
The exposed information potentially included names, contact details, dates of birth, Social Security numbers, driver’s license and other government ID numbers, medical and disability records, financial account information, payment card data, and employment-related records. Brown Health Medical Group-MA reported the incident to the HHS Office for Civil Rights and state authorities in Massachusetts and Vermont, said no threat actor had been publicly identified or linked to a ransomware or extortion claim, and is offering affected individuals 24 months of credit monitoring, fraud detection, and identity theft protection services.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
A file review completed on June 22, 2026 determined that accessed files contained personal, medical, financial, and employment-related information. Brown Health said not all data types were affected for every individual.
On December 16, 2025, Brown Health Medical Group-MA discovered unauthorized activity on the legacy file server, isolated the system, and launched an investigation. The organization later said the breach was confined to that server.
Brown Health Medical Group-MA said an unauthorized third party accessed a legacy file server at its Hawthorn location between December 15 and December 16, 2025. The incident did not involve the organization's electronic medical record system.
Following the breach, Brown Health Medical Group-MA said it implemented enhanced technical safeguards and additional security measures. The organization also said it was retraining employees in response to the incident.
Brown Health Medical Group-MA began notifying more than 311,000 individuals about the breach and the categories of exposed information. The organization offered 24 months of complimentary credit monitoring, fraud detection, and identity protection or restoration services.
Brown Health Medical Group-MA reported the incident to the Vermont and Massachusetts Attorneys General and notified the US Department of Health and Human Services. Its HHS filing said 311,760 individuals were potentially affected, including 290,357 Massachusetts residents and 86 Vermont residents.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcesecurityaffairs.com
Open sourcesecurityweek.com
Open sourcehipaajournal.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Medical Computer Business Services (MCBS), a Georgia-based medical billing and practice-management firm, disclosed that a September 2025 network intrusion exposed the personal, insurance, and medical information of **1,261,464 individuals**. The company said unauthorized actors accessed its systems between **September 22 and September 26, 2025**, and that the compromised data may include names, addresses, Social Security numbers, dates of birth, insurance identifiers, medical histories, diagnoses, and treatment details. MCBS reported that the affected records were tied to data it managed for **seven healthcare organizations**. The incident has been linked to the **PEAR ransomware** group, which claimed responsibility shortly after the intrusion and alleged it stole more than **3 TB** of data, including patient `PII`/`PHI`, financial records, HR documents, payment information, and emails. MCBS said its investigation concluded on **May 28, 2026**, while U.S. Department of Health and Human Services breach-tracker data lists the event among major healthcare breaches, underscoring the scale of the exposure and the risk to patients and partner providers.
Jul 30, 2026
**Central Maine Healthcare (CMH)** disclosed a data breach that exposed sensitive information for **145,381 individuals**, including patients and current/former employees. Attackers maintained unauthorized access to CMH systems for more than two months, from **March 19 to June 1** (discovered June 1), affecting an integrated healthcare delivery system serving roughly **400,000** people and operating facilities including **Central Maine Medical Center**, Bridgton Hospital, and Rumford Hospital. CMH reported that exposed data varied by individual but could include **full names, dates of birth, treatment information, dates of service, provider names, health insurance information, and Social Security numbers**. CMH’s investigation and impact analysis concluded on **November 6, 2025**, and the organization has been notifying affected individuals on a rolling basis while offering **free credit monitoring** and establishing a dedicated support line; CMH also warned of elevated risk of **phishing, impersonation, and fraud**, advising patients to review provider and insurance statements for suspicious activity.
Jun 29, 2026
Radiology Associates of Richmond said threat actors gained unauthorized access to its internal systems on or about July 25, 2025, leading to the potential viewing or acquisition of files containing electronic personal information and protected health information for **266,183 individuals**. After a forensic investigation and manual document review concluded on April 6, 2026, the Virginia-based imaging provider determined the exposed data may include names, Social Security numbers, government-issued ID numbers, financial account information, medical records, health insurance details, and possibly payment card data. The provider said it engaged external cybersecurity specialists to contain the intrusion and assess its scope, and began mailing notification letters to affected individuals on May 21, 2026. People whose Social Security numbers were involved were offered complimentary credit monitoring and identity theft protection services. The disclosure marks the organization's second major cybersecurity incident in a short period, following a separate breach tied to an April 2024 event that affected roughly **1.4 million** individuals.
Jun 29, 2026