Brookhaven ENT Allergy and Facial Surgery, an ear, nose, and throat practice based in Brookhaven, Mississippi, has confirmed a data breach after a hacking incident compromised its electronic medical record system and network server. The practice reported the incident to the U.S. Department of Health and Human Services Office for Civil Rights, disclosing that more than 30,000 patients may have had personal and health information exposed. Companies that maintain sensitive medical and personal records have a responsibility to protect that information from unauthorized access, and patients affected by this breach deserve to understand what happened and what options are available to them.
Brookhaven ENT Allergy and Facial Surgery’s Data Breach Investigation
According to a filing with the HHS Office for Civil Rights, Brookhaven ENT Allergy and Facial Surgery experienced a hacking/IT incident that affected data stored on its electronic medical record system and network server. The filing indicates that a business associate was involved in the incident and that approximately 30,403 individuals were affected. As of this writing, the practice has not publicly released a detailed notification letter describing the specific circumstances of the intrusion, how it was discovered, or the exact dates the breach began and ended, and this article will be updated if that information becomes publicly available.
Healthcare providers, including specialty practices like ENT and allergy clinics, have become frequent targets for cybercriminals in recent years. Medical practices typically store a dense combination of protected health information, insurance details, and personal identifiers in centralized systems, making them attractive targets for ransomware groups and data thieves who can monetize stolen records on illicit marketplaces or use them for follow-on fraud. Smaller, independent practices such as Brookhaven ENT often operate with more limited in-house cybersecurity resources than large hospital systems, which can make them more vulnerable to phishing attacks, credential theft, and exploitation of unpatched network vulnerabilities.
When a hacking incident specifically involves a network server and an electronic medical record system, as this one did, the exposure can extend beyond a single office’s records. Network servers frequently store data in bulk, meaning that a single successful intrusion can expose a large number of patient files at once rather than isolated incidents. This is consistent with the reported figure of over 30,000 individuals affected, which is substantial for what appears to be a single-location specialty practice.
Federal law generally requires HIPAA-covered entities to notify the Department of Health and Human Services of breaches affecting 500 or more individuals within 60 days of discovery, and to notify affected individuals directly as well. The submission date associated with this filing is July 24, 2026. It is common for the investigation into how an intrusion occurred, what specific data elements were accessed, and how long attackers had access to remain ongoing even after the initial regulatory notification is filed, which is one reason more specific details are not always available to the public immediately.
Patients whose information was involved in a healthcare data breach of this kind face real, practical risks. Medical identity theft, in which a stolen identity is used to obtain healthcare services or prescriptions in a victim’s name, can be more difficult to detect and unwind than standard financial identity theft, sometimes contaminating a person’s own medical records with someone else’s history. Combined with any exposed Social Security numbers or financial information, affected individuals may also face an elevated risk of traditional identity theft, tax fraud, and targeted phishing attempts that reference the breach to appear legitimate.
The healthcare sector as a whole continues to report more data breaches to federal regulators each year than almost any other industry, and specialty outpatient practices have increasingly been swept into that trend alongside large hospital networks and insurers. Attackers frequently target the vendors and IT systems that support smaller practices precisely because those environments can offer a path into valuable patient data without the layered defenses a larger health system might maintain. The involvement of a business associate in this filing is a common pattern across healthcare breaches generally, since many practices rely on third-party companies to host, process, or manage electronic medical record systems, billing platforms, and network infrastructure, any one of which can become the point of compromise.
How quickly and thoroughly a healthcare organization responds once a hacking incident is discovered can meaningfully affect the outcome for patients. A prompt, transparent notification helps affected individuals take protective steps sooner, while delayed or incomplete disclosure can leave people unaware that their information is circulating and at risk for longer than necessary. As this matter develops, it will be worth watching whether Brookhaven ENT Allergy and Facial Surgery releases additional detail confirming exactly when the intrusion began, how it was detected, and what specific safeguards are being put in place to prevent a recurrence.
When Did This Breach Occur?
Brookhaven ENT Allergy and Facial Surgery’s breach was submitted to the HHS Office for Civil Rights on July 24, 2026. The practice has not publicly disclosed the specific date or date range during which the hacking incident occurred or was discovered. This article will be updated if the practice releases a formal notification letter with more precise dates.
What Information Was Breached?
The HHS Office for Civil Rights filing identifies the location of the breached information as the practice’s electronic medical record system and network server, and categorizes the incident as a hacking/IT incident involving a business associate. Brookhaven ENT Allergy and Facial Surgery has not publicly released a specific list of the individual data elements involved, such as which combination of names, Social Security numbers, medical record numbers, insurance information, or treatment details may have been exposed. This article will be updated if the practice discloses a more detailed breakdown of the information involved.
What You Can Do
If you have received a notice from Brookhaven ENT Allergy and Facial Surgery, or believe you may have been affected by this breach, there are several steps you can take to help protect yourself:
- Monitor your medical bills, insurance statements, and explanation-of-benefits notices for services you did not receive.
- Request a copy of your medical records and review them for unfamiliar treatments or diagnoses that could indicate medical identity theft.
- Monitor your bank and credit card statements for unauthorized charges.
- Consider placing a fraud alert or credit freeze with the three major credit bureaus if personal identifiers such as your Social Security number may have been involved.
- Be cautious of unsolicited calls, emails, or texts referencing the breach, as scammers often use news of a data breach to run phishing schemes.
File a Data Breach Lawsuit Against Brookhaven ENT Allergy and Facial Surgery
If you were notified that your information was involved in the Brookhaven ENT Allergy and Facial Surgery data breach, you may have legal options available to you.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
