Baltimore Medical System (BMS), a healthcare provider operating nine practices in the Baltimore area, experienced a data breach involving unauthorized access to its systems between July 2 and July 20, 2025. The company detected suspicious activity, investigated the incident with third-party cybersecurity specialists, and secured its network. BMS additionally notified law enforcement. Notifications regarding the breach were issued on the company's website on September 26, 2025, and December 10, 2025, with a supplemental notice on March 27, 2026.
While the exact number of affected individuals has not been specified, BMS is in the process of notifying potentially affected individuals. The accessed or copied files included names and additional unspecified types of information, which may vary per individual. No sources confirm the exposure of SSN, medical, or financial data. The incident primarily affected residents in Maryland.
Details about the full scope of the incident can emerge later, and notices to affected individuals may be delayed.