Southfield Rehabilitation Company LLC, doing business as Surgeons Choice Medical Center, disclosed a data breach in August 2026 that exposed patients’ Social Security numbers and health records. The exact number of affected individuals has not been publicly disclosed. Anyone who received care at this facility should monitor their credit reports and consider placing a credit freeze immediately.
| Company | Southfield Rehabilitation Company LLC d/b/a Surgeons Choice Medical Center |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Social Security Numbers, Health Records |
| People Affected | Not Publicly Disclosed |
| Attack Method | Unspecified/Unauthorized Access |
| Regulators Notified | Vermont Attorney General |
What Happened in the Surgeons Choice Medical Center Data Breach?
Southfield Rehabilitation Company LLC, operating as Surgeons Choice Medical Center, recently confirmed a data breach involving sensitive patient information. The organization filed a formal notification describing unauthorized access to systems holding personal and medical data. This disclosure alerts patients that their private information may have been compromised.
According to the notification, the breach involved exposure of Social Security numbers and health records. The exact discovery date has not been publicly disclosed. However, the company issued its notification in August 2026, which is when affected individuals and regulators first learned of the incident.
Details about the specific method of attack have not been made public. As a result, it remains unclear whether the breach stemmed from a ransomware attack, an unauthorized network intrusion, or another form of compromise. Because full technical details are limited, this article focuses on the confirmed facts of what data was exposed and how patients can respond.
Following discovery, the medical center reportedly began an internal review to understand the scope of the incident. This type of investigation typically involves forensic specialists who examine system logs and access records. In addition, organizations often work to determine exactly which records were viewed or taken during this process.
Who Was Affected?
The breach may affect patients who received care or services through Surgeons Choice Medical Center. Because the notification centers on health records, those impacted are likely current or former patients. In addition, some employees could also be affected if their data was stored in overlapping systems.
The exact number of affected individuals has not been publicly disclosed. Therefore, the full scope of this breach in terms of total records affected remains unknown at this time. However, any breach involving Social Security numbers and health records is considered serious, regardless of the total count.
It is not yet clear whether the breach affected patients across multiple states or was limited to a specific region. Because medical centers often serve local and regional patient bases, the impact may be geographically concentrated. Nonetheless, patients who received treatment from this provider should assume they could be affected until told otherwise.
What Information Was Potentially Exposed?
The notification specifically identifies two categories of exposed information. These categories represent highly sensitive data that could be misused if it falls into the wrong hands. Understanding what was exposed helps affected individuals gauge their personal risk.
- Social Security Numbers
- Health Records
Exposure of Social Security numbers creates a significant risk of identity theft. Criminals can use this information to open new credit accounts, file fraudulent tax returns, or apply for loans in a victim’s name. Because Social Security numbers rarely change, this type of exposure can create risks that last for years.
Health records exposure introduces a different but equally serious threat. For example, stolen medical information can be used to commit medical identity theft, where someone else receives treatment using a victim’s identity. This can result in inaccurate medical records, billing fraud, and complications with future insurance claims. As a result, victims may face both financial and health-related consequences.
What Is the Company Doing?
In response to the breach, Southfield Rehabilitation Company LLC filed formal notifications with relevant state authorities. This step is a standard part of breach response and helps ensure regulatory oversight of the situation. The company also notified affected individuals, as required under applicable data breach notification laws.
The organization filed a notification with the Vermont Attorney General, confirming the incident and the categories of data involved. This filing demonstrates the company’s compliance with legal reporting obligations. In addition, such filings often prompt further scrutiny from regulators to confirm that the response is adequate.
Beyond notification, medical centers facing this type of incident typically take additional remedial steps. These often include strengthening network security, reviewing access controls, and monitoring for further suspicious activity. However, the source notification does not specify the exact remediation measures Surgeons Choice Medical Center has implemented.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Affected individuals should regularly check their credit reports for unfamiliar accounts or inquiries. Because Social Security numbers were involved, criminals could attempt to open new lines of credit using stolen identities. Reviewing your credit report allows you to catch fraudulent activity early.
You can request free credit reports from each of the three major credit bureaus. In addition, consider spacing these requests throughout the year for ongoing monitoring. If you notice any unauthorized accounts, report them immediately to the credit bureau and consider contacting a data breach attorney for guidance.
Consider a Fraud Alert or Credit Freeze
Because Social Security numbers were exposed, placing a fraud alert or credit freeze is a strong protective step. A fraud alert requires lenders to verify your identity before opening new credit. A credit freeze goes further by restricting access to your credit file entirely.
Both options are free and can be requested directly through the credit bureaus. However, a credit freeze may require you to temporarily lift it when applying for new credit yourself. Despite this small inconvenience, it remains one of the most effective ways to prevent identity thieves from opening accounts in your name.
Protect Against Medical Identity Theft
Because health records were exposed, affected individuals should watch for signs of medical identity theft. This includes reviewing insurance statements and explanation-of-benefits notices for unfamiliar treatments or charges. If something looks unfamiliar, contact your insurer or healthcare provider right away.
In addition, request a copy of your medical records periodically to check for inaccuracies. Medical identity theft can lead to incorrect information in your health file, which could affect future treatment decisions. Correcting these errors early helps protect both your finances and your health.
Stay Alert to Phishing Attempts
Following a data breach, scammers often use exposed information to craft convincing phishing emails or phone calls. These messages may pretend to be from the medical center, a bank, or a government agency. Because the scammers may reference real personal details, these attempts can seem legitimate.
Never click on links or provide personal information in response to unsolicited messages. Instead, verify any request by contacting the organization directly using a known, official phone number. This simple habit can prevent scammers from gaining further access to your accounts or identity.
Know Your Legal Options
If you were affected by this breach, you may have legal options available to you. Many individuals affected by data breaches choose to consult an attorney to understand potential compensation. This is especially relevant when sensitive data like Social Security numbers and health records are involved.
A data breach attorney can review your specific circumstances and explain any applicable deadlines. Because statutes of limitations vary by state, acting sooner rather than later is generally advisable. Many attorneys offer free consultations, so seeking legal advice carries little risk for affected individuals.
More Information
View the public data breach notification listing from Vermont Attorney General