In November 2025, Columbia Medical Practice, a healthcare organization based in Columbia, Maryland, experienced a ransomware attack. This incident, disclosed on January 22, 2026, by Strauss Borrelli PLLC, involved unauthorized access to sensitive personal and protected health information.
The breach affected approximately 3,000 individuals, compromising data types such as names, addresses, phone numbers, dates of birth, Social Security numbers (SSNs), driver's license numbers, passport numbers, and other government IDs. It also involved protected health information including health service details, treatment information, diagnoses, prescription details, medical history, and assigned physicians. Financial data, specifically patient account numbers and financial account numbers, along with health insurance subscriber/ID numbers, were also involved. The full extent of data compromised has not yet been publicly confirmed.
Details are still emerging, and direct mailed notifications to affected individuals are planned after a review of files. It is important to note that information about data breaches can evolve as investigations proceed and additional facts become available.