What Happened in the Dermatology Partners Data Breach?
Dermatology Partners, a dermatology provider with more than 30 offices spread across Pennsylvania, Delaware, and Maryland, has told patients about a security incident tied to its Catonsville, Maryland location. The practice says an unknown individual gained entry to the data system used at that office. As a result, patient information may have been viewable during the intrusion window.
According to the company, the unauthorized access began in late February 2026 and continued for close to two weeks before it was shut down in early March 2026. This means the intruder had a meaningful stretch of time inside the system. Because of that extended window, investigators could not fully rule out that records were viewed while access remained open.
Dermatology Partners conducted a forensic review after containing the intrusion. That review reportedly found no direct proof that files were copied or removed from the system. However, the company also acknowledged it could not say with certainty which specific patient records the intruder actually viewed. Rather than notify only a narrow group of confirmed victims, the practice chose to alert every patient who had been seen at the Catonsville office during the relevant period.
Notice of the incident appeared on the company’s website several months after the intrusion ended. The gap between containment and public notice is common in healthcare breaches, since forensic teams often need extended time to determine scope and coordinate legal review. Dermatology Partners has stated it is cooperating with ongoing investigations and has added new access controls with help from outside cybersecurity professionals.
Who was affected?
The breach affects patients who received care at the Catonsville office at 716 Maiden Choice Lane. Anyone treated there during the intrusion window faces some level of exposure risk, even without direct confirmation their individual file was opened. Dermatology Partners has not released an exact total count of affected patients.
Because dermatology practices often treat patients across a wide age range, the affected population could include minors alongside adult patients. In addition, patients from Pennsylvania, Delaware, and Maryland who used the Catonsville location may all be represented in the notification group. The lack of a disclosed total number makes it difficult to gauge the full scale, but the decision to notify broadly suggests a sizable patient population may be involved.
What Information Was Potentially Exposed?
Dermatology Partners identified several categories of information that may have been viewable during the unauthorized access. This data goes well beyond basic contact details and touches on sensitive medical history. As a result, the potential harm to patients extends past typical financial fraud concerns.
- Patient names
- Dates of birth
- Home addresses
- Contact information
- Medical record numbers
- Dates of service
- Diagnosis and treatment information
- Health insurance information
Medical record numbers and treatment histories cannot simply be replaced the way a stolen credit card can. Because of this, patients whose diagnosis and treatment details were exposed face a longer-term risk of medical identity theft. Someone with this information could file fraudulent insurance claims or seek treatment under a victim’s identity, creating billing and coverage problems that may take months to untangle.
In addition, the combination of names, dates of service, and provider details makes for convincing phishing material. Scammers frequently use real medical details to craft messages that appear to come from a legitimate provider or insurer. Patients should therefore treat any unexpected communication referencing this incident with caution, even if it looks authentic at first glance.
What is the company doing?
Once the intrusion was discovered, Dermatology Partners moved to contain the unauthorized access and began a forensic investigation into what happened. The company says it is cooperating with ongoing investigations related to the incident. It also chose to notify its entire Catonsville patient population rather than limit notice to a smaller, confirmed group.
Following the investigation, the practice implemented enhanced access controls across its systems. It has also engaged outside cybersecurity professionals to help prevent a similar event from happening again. These steps reflect a broader effort to strengthen defenses at the affected office and reduce the chance of repeat incidents.
What Should Affected Individuals Do?
Monitor Insurance Statements and Medical Records
Patients who received care at the Catonsville office should carefully review statements from their health insurance provider. Look for any services, claims, or provider visits you don’t recognize. Because medical record numbers and insurance details were involved, fraudulent claims filed under your name are a real possibility.
If you spot anything unfamiliar, contact your insurer right away to dispute the charge. Request a copy of your medical records periodically to confirm no fraudulent treatment history has been added. Catching this early can prevent larger complications with future coverage or care.
Place a Fraud Alert or Credit Freeze
Given that personal identifiers like names, birth dates, and addresses were exposed, placing a fraud alert with the major credit bureaus is a reasonable precaution. A fraud alert requires creditors to take extra steps to verify your identity before opening new accounts in your name. This makes it harder for someone to use your information fraudulently.
For stronger protection, consider a credit freeze instead. A freeze restricts access to your credit report entirely until you lift it. Because this incident involved a lengthy window of unconfirmed access, a freeze offers more peace of mind than monitoring alone.
Watch for Phishing Attempts Referencing the Breach
Scammers often exploit breach notifications to trick victims into revealing more information. Be wary of unsolicited calls, emails, or letters that reference your treatment history, provider, or this specific incident. Legitimate companies rarely ask for sensitive details over the phone or through unexpected messages.
If you receive a suspicious communication, don’t click links or provide personal information. Instead, contact Dermatology Partners directly using a verified phone number to confirm whether the message is genuine. This simple step can prevent a second wave of harm following the original breach.
Keep Records and Monitor Your Credit Reports
Hold onto any notification letter you received from Dermatology Partners, since it documents your inclusion in the breach. This letter may prove useful if you later need to demonstrate you were affected. In addition, request free copies of your credit reports from the three major bureaus.
Review those reports regularly for accounts or inquiries you don’t recognize. Because identity thieves sometimes wait months before using stolen data, ongoing vigilance matters more than a single check right after notification. Consistent monitoring gives you the best chance of catching fraud early.
More Information
Official data breach notification from Delaware Attorney General
Official data breach notification from Oregon Department of Justice
Official data breach notification from Vermont Attorney General