Mid Florida Dermatology & Plastic Surgery, a medical group practice serving patients across Florida, discovered a cyber incident in its digital environment on March 30, 2026. The breach reportedly occurred between March 26 and March 30, 2026, and was later disclosed to the U.S. Department of Health and Human Services (HHS OCR) on May 1, 2026, as a hacking/IT incident affecting 85,585 individuals. The ransomware group Qilin claimed responsibility for the attack and allegedly posted details about the breach on the dark web on April 25, 2026.
The information exposed in this incident reportedly includes names, addresses, dates of birth, passport numbers, Social Security numbers, driver’s license numbers, Medicare numbers, other government identification numbers, financial account numbers, financial account access information, health insurance information, and medical information. The HHS OCR filing does not specify the data elements. The total number of affected individuals is reported as 85,585. It remains unclear whether every affected person has received an individual notification letter.
Additional details about the incident, including confirmation of specific data elements involved and the full extent of the impact, may emerge as investigations progress. The company has not issued a public breach statement, with the HHS OCR filing serving as the clearest official regulatory record.