Mid Florida Dermatology & Plastic Surgery confirmed a data breach discovered in March 2026 after an unauthorized party accessed its network for several days. The breach affects 85,585 patients, potentially exposing names, Social Security numbers, financial data, and medical information. Affected individuals should place a credit freeze or fraud alert and monitor their credit reports immediately.
| Company | Mid Florida Dermatology & Plastic Surgery |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Names, Addresses, Dates of Birth, Passport Numbers, Social Security Numbers, Driver’s License Numbers, Medicare Numbers, Financial Account Numbers, Health Insurance Information, Medical Information |
| People Affected | 85,585 individuals |
| Attack Method | Unauthorized Network Access |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Mid Florida Dermatology & Plastic Surgery Data Breach?
Mid Florida Dermatology & Plastic Surgery, a medical group that operates 33 locations across central Florida, has confirmed a data breach affecting tens of thousands of patients. The practice detected unusual activity within its computer systems in March 2026. This discovery prompted an immediate internal review and the start of a broader investigation into what had happened.
According to the practice’s notice, a forensic investigation later determined that an unauthorized third party had access to its network for several days before the activity was detected. During that window, the intruder may have viewed or taken files containing patient information. Because the timeline spans only a few days, investigators focused on identifying exactly which files were reachable during that period.
Following the discovery, Mid Florida Dermatology & Plastic Surgery brought in forensic specialists to determine the scope of the intrusion. The review process took several months to complete. As a result, the practice did not publish its notice describing the incident until September 2026, which is when affected patients and regulators were formally informed.
Who was affected?
The breach affects patients of Mid Florida Dermatology & Plastic Surgery across its central Florida locations. Because the practice operates dozens of offices, the affected population likely includes patients who visited any of its various dermatology and plastic surgery clinics over time. The practice has not indicated that employees, rather than patients, were involved in this particular incident.
Mid Florida Dermatology & Plastic Surgery reported that 85,585 individuals were affected by this breach. This is a substantial number of patients, and it reflects the scale of a large regional medical group. The notice does not specify whether minors were among those affected, though pediatric dermatology patients are not uncommon at practices of this size.
Additionally, the practice noted that the specific information exposed varied from person to person. This means not every patient had the same categories of data compromised. Some individuals may have had only limited information involved, while others may have had more extensive records exposed.
What Information Was Potentially Exposed?
The data review conducted after the intrusion identified a wide range of personal and medical information that may have been accessed or acquired by the unauthorized party. Because the exposure varied by individual, not every category below applies to every affected patient. Still, the full list of potentially impacted data categories is extensive.
- Names
- Addresses
- Dates of birth
- Passport numbers
- Social Security numbers
- Driver’s license numbers
- Medicare numbers
- Other government identification numbers
- Financial account numbers
- Financial account access information
- Health insurance information
- Medical information
This combination of data creates considerable risk for identity theft. When a Social Security number is paired with a date of birth and a government ID number, criminals can use that information to open new credit accounts, file fraudulent tax returns, or apply for loans in a victim’s name. Because financial account numbers were also involved, direct account takeover or fraudulent withdrawals are additional concerns.
Beyond financial fraud, the exposure of health insurance information and medical details raises the risk of medical identity theft. This occurs when someone uses stolen insurance information to obtain medical care or prescriptions under another person’s name. In addition, passport numbers and driver’s license numbers could be used to create fake identification documents, which makes this breach especially concerning for long-term identity protection.
What is the company doing?
In response to the breach, Mid Florida Dermatology & Plastic Surgery stated that it is reviewing its security policies and procedures. The practice is also taking steps intended to reduce the chances of a similar incident happening again. These measures reflect a standard post-breach response aimed at closing any gaps that allowed the unauthorized access to occur.
Furthermore, the practice notified the HHS Office for Civil Rights about the breach, as required under federal law for incidents affecting protected health information. This notification confirms the scope of 85,585 affected individuals. The practice also posted a notice on its website in September 2026 to inform patients directly about what happened and what information may have been involved.
What Should Affected Individuals Do?
Monitor Your Credit Reports Closely
Affected patients should request copies of their credit reports and review them for any unfamiliar accounts or inquiries. You can obtain free credit reports from each of the three major credit bureaus. Checking these reports regularly over the coming months is one of the most effective ways to catch fraud early.
Because this breach included Social Security numbers and financial account details, the risk of new account fraud is elevated. If you spot any unauthorized activity, report it to the credit bureau immediately. Early detection often makes the difference between a minor inconvenience and a drawn-out recovery process.
Consider a Credit Freeze or Fraud Alert
Given that Social Security numbers, driver’s license numbers, and financial account information were potentially exposed, affected individuals should strongly consider placing a credit freeze with each major bureau. A freeze prevents new creditors from accessing your credit file, which makes it much harder for criminals to open accounts in your name.
Alternatively, a fraud alert requires lenders to take extra verification steps before approving credit in your name. This option is less restrictive than a freeze but still provides a meaningful layer of protection. Either step can be done online or by phone, and both are free to set up.
Protect Against Medical Identity Theft
Because health insurance information and medical details were involved, patients should watch for unfamiliar claims or statements from their insurance provider. Request an explanation of benefits report periodically and review it for services you did not receive. This can reveal whether someone has used your insurance information fraudulently.
In addition, consider contacting your health insurer directly if you notice anything suspicious. Many insurers have fraud departments specifically equipped to investigate unauthorized use of a policyholder’s benefits. Acting quickly can limit the damage and help correct your medical records if errors appear.
Stay Alert for Phishing Attempts
Criminals often use stolen personal information to craft convincing phishing emails, texts, or phone calls. Because this breach included detailed personal identifiers, affected patients should be especially cautious of messages claiming to be from Mid Florida Dermatology & Plastic Surgery, a bank, or a government agency. Never click links or share information in response to unsolicited messages.
Instead, verify any communication by contacting the organization directly through a known phone number or official website. This simple habit can prevent scammers from tricking you into revealing additional information. Staying skeptical of urgent or threatening messages is one of the best defenses available.
Consult a Data Breach Attorney
Given the sensitive nature of the information involved, affected individuals may want to speak with a data breach attorney about their legal options. Many attorneys offer free case evaluations and can explain whether you qualify to join a class action or pursue individual compensation. This step costs nothing upfront and can clarify your rights.
Moreover, an attorney can help you understand applicable deadlines for filing a claim. Because these deadlines vary by state and case, getting informed guidance early is important. A free consultation can also help you determine whether any settlement fund may eventually be available to affected patients.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.