A ransomware group known as Wallstreet has claimed an attack on Breast Implant Center of Hawaii, a Kailua-Kona cosmetic surgery clinic, potentially exposing patient medical and financial records. The clinic has not publicly confirmed the breach. Affected individuals should monitor credit reports, watch for phishing attempts referencing medical details, and consider a credit freeze while official confirmation is awaited.
| Company | Breast Implant Center of Hawaii |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Patient Names and Contact Information, Medical and Treatment Records, Appointment and Consultation Histories, Insurance or Billing Information, Payment Card or Financial Account Details, Dates of Birth, Social Security Numbers |
| People Affected | Not Publicly Disclosed |
| Attack Method | Ransomware |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Breast Implant Center of Hawaii Data Breach?
A ransomware group calling itself Wallstreet has claimed responsibility for an attack on Breast Implant Center of Hawaii. The clinic, based in Kailua-Kona, provides breast augmentation, implant revision, breast lifts, and body contouring services to patients across the islands. As of this writing, the Breast Implant Center of Hawaii data breach has not been publicly confirmed by the practice itself.
The claim surfaced on a dark web leak site associated with the Wallstreet ransomware group. Groups like this typically infiltrate a victim’s network, copy sensitive files, and then threaten to publish or sell the stolen data unless a ransom is paid. However, specific details about how the attackers gained access, or when the intrusion actually began, have not been publicly disclosed.
Because this incident stems from a threat actor’s own claim rather than a statement from the clinic, many facts remain unverified. There is currently no public confirmation of a forensic investigation, nor any timeline for when unauthorized access may have first occurred. As a result, patients are left waiting for official word from the practice about what happened and what information was involved.
Ransomware groups frequently target healthcare providers because medical records carry high value on illicit markets. In addition, smaller clinics often have fewer cybersecurity resources than large hospital systems. This makes practices like Breast Implant Center of Hawaii an attractive target for extortion-based attacks.
Who was affected?
The population affected by this reported breach likely includes current and former patients of Breast Implant Center of Hawaii. Because the clinic offers cosmetic surgical procedures, the exposed records could include highly personal medical histories. This may also extend to consultation records for individuals who never underwent a procedure.
At this time, the exact number of affected individuals has not been publicly disclosed. Similarly, it is unclear whether employee records were included alongside patient data. Given that the clinic serves patients throughout Hawaii, the geographic impact of this incident is likely concentrated within the state, though patients who have since moved elsewhere could also be affected.
Because a plastic surgery practice was targeted, patients may feel particularly concerned about privacy. Cosmetic procedure records often include sensitive photographs, consultation notes, and payment details. This adds an extra layer of concern beyond typical medical record exposure.
What Information Was Potentially Exposed?
Specific data fields have not been officially confirmed. However, based on the nature of the business and the type of information healthcare providers typically store, several categories of data could be at risk.
- Patient names and contact information
- Medical and treatment records related to cosmetic procedures
- Appointment and consultation histories
- Insurance or billing information
- Payment card or financial account details
- Dates of birth
- Possibly Social Security numbers, if collected for billing or insurance purposes
If these categories are confirmed, the risk to affected patients could be significant. For example, medical identity theft can occur when stolen health information is used to fraudulently obtain treatment or prescriptions in someone else’s name. This can create tangled medical records that are difficult and time-consuming to correct.
In addition, if financial or billing details were exposed, patients could face a heightened risk of credit card fraud or unauthorized charges. Because cosmetic surgery records are also sensitive in nature, there is a risk of embarrassment or targeted phishing attempts that reference specific procedures. This could make scam attempts appear more convincing to unsuspecting victims.
What is the company doing?
Because this incident is currently based on a claim made by the Wallstreet ransomware group, there is no public record of a formal response from Breast Implant Center of Hawaii. The clinic has not issued a statement confirming the breach, and it has not described any investigation, remediation, or notification process at this time.
As a result, it remains unknown whether the practice has engaged a forensic cybersecurity firm or notified regulators. It is also unclear whether affected patients will be offered credit monitoring or identity protection services. Patients concerned about their information should watch for official communication directly from the clinic in the coming weeks.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Affected individuals should regularly check their credit reports for unfamiliar accounts or inquiries. You can request free reports from all three major credit bureaus through AnnualCreditReport.com. Reviewing these reports on a rotating basis throughout the year can help you catch suspicious activity early.
Because medical breaches sometimes lead to new account fraud, this step is especially important. If you notice any unfamiliar charges or accounts, report them to the credit bureau immediately. Acting quickly can limit the financial damage caused by identity thieves.
Consider a Fraud Alert or Credit Freeze
If Social Security numbers or financial account details were involved, placing a fraud alert on your credit file is a smart precaution. A fraud alert requires lenders to take extra steps to verify your identity before opening new credit. This can make it harder for criminals to open accounts in your name.
For stronger protection, you may also consider a full credit freeze. This restricts access to your credit file entirely, which means most new credit applications will be automatically rejected. While a freeze takes a bit more effort to manage, it offers one of the most effective defenses against identity theft.
Watch for Healthcare-Related Fraud
Because this breach involves a medical practice, patients should carefully review any insurance statements or medical bills they receive. Look for unfamiliar procedures, provider visits, or billing codes that do not match your actual care history. This could be a sign that your medical identity has been misused.
In addition, request a copy of your medical records periodically to confirm their accuracy. If you spot anything unusual, report it to your insurance provider and the healthcare provider involved right away. Correcting fraudulent medical records early can prevent complications with future treatment or coverage.
Stay Alert for Phishing Attempts
Following any healthcare data exposure, scammers often send emails or texts posing as the affected organization. These messages may reference your specific procedure or appointment details to appear legitimate. Because of this, you should never click links or provide personal information in response to unsolicited messages.
Instead, contact the clinic directly using a phone number you find independently, not one provided in a suspicious message. This simple habit can prevent you from falling victim to a targeted phishing scam. If something feels off, it is always safer to verify before responding.
Consult a Data Breach Attorney
If you believe your information was exposed in this incident, it may be worth speaking with a data breach attorney. Many offer free consultations to help you understand your legal options. This can include potential compensation if the breach is later confirmed and formal notifications are issued.
Because class action lawsuits often follow confirmed healthcare data breaches, staying informed about developments in this case is important. An attorney can help you monitor eligibility requirements and any filing deadlines. This ensures you do not miss an opportunity to seek compensation if one becomes available.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.