Downriver Pediatric Associates PC is a pediatric practice in Brownstown Township, Michigan. The practice has notified patients about a data security incident that did not happen on its own network but at the outside company that hosted its electronic health records. Families trust pediatric offices with children’s health information, so the details of who held that data and what happened to it matter.
Downriver Pediatric Associates’s Data Breach Investigation
According to the notice posted on the practice’s website, Downriver Pediatric Associates began mailing notification letters on October 8, 2026. The letters went to certain patients whose information was involved in an incident at Technical Solutions Group LLC, referred to as TSG, a company the practice previously used to host its electronic health records system.
The practice says TSG reported that it suffered a cyberattack in June 2026 that affected information belonging to many of its customers, including Downriver. During the attack, the bad actors encrypted information on TSG’s systems and left a note claiming they had taken data held by TSG. TSG told Downriver about the incident and said it had begun its own investigation to determine the nature and scope of what happened.
On September 16, 2026, TSG informed Downriver that it was unable to recover the encrypted data it hosted on the practice’s behalf. TSG also could not determine what Downriver information, if any, the attackers accessed or took. The practice states that it does not know for certain whether any patient’s information was accessed or taken. Even so, it chose to notify every patient whose information was kept in the EHR system TSG hosted, saying it did so out of an abundance of caution.
The incident also has a practical consequence beyond privacy. Because TSG could not recover the encrypted data, the practice says treatment records created between June 2025 and June 2026 may no longer be available to review or access. For families, that raises a separate concern about continuity of care, in addition to the risk that sensitive information was copied.
Downriver emphasizes that the incident involved TSG’s systems and not systems that Downriver owns, operates or administers. The practice says it is no longer using TSG to host its electronic health records. It has also set up a dedicated incident response line for patient questions, staffed on weekdays during extended daytime and evening hours Eastern Time, except for major U.S. holidays.
Third-party vendor incidents like this one are a recurring feature of healthcare data breaches. Medical practices frequently rely on outside companies to host records, process billing or manage software, which means a single compromise at one vendor can reach many unrelated practices at once. The patients affected often have never heard of the vendor involved, and they learn about the problem only when the practice they do know sends a letter. Responsibility for protecting the information, however, generally remains with the healthcare provider that collected it, even when the data sits on another company’s servers.
Ransomware-style attacks, in which criminals encrypt a victim’s files and demand payment, often pair the encryption with a claim of data theft to increase pressure. A claim made in a ransom note is not proof that data was copied, and the practice’s notice is careful to say it cannot confirm what, if anything, was taken. Still, when the affected records include Social Security numbers and medical details, even an unconfirmed possibility is reason for patients to stay alert.
The practice’s notice does not state how many patients were affected, and we have not located a count in a regulator’s public listing. This page therefore gives no number. We will not estimate one. If a count is published by the practice or a regulator, it can be added here.
Patients who receive a letter should keep it. It is the most reliable source for what applies to their own situation. Parents and guardians should also be aware that a child’s information can be misused for years before anyone notices, because minors typically have no credit history to monitor. This page will reflect only what the practice has made public, and where a detail has not been disclosed, we say so rather than speculate.
When Did This Breach Occur?
The practice says the cyberattack at its vendor, Technical Solutions Group, took place in June 2026. On September 16, 2026, the vendor told Downriver that it could not recover the encrypted data it hosted. Downriver began mailing notification letters to patients on October 8, 2026.
What Information Was Breached?
The practice says the potentially involved files varied by patient but could have included a patient’s name and one or more of the following: Social Security number, driver’s license number, date of birth, treating physician, dates of service, medication information, insurance information, and treatment or diagnostic information. Neither the practice nor its vendor has confirmed that any of this information was actually taken. The practice notified patients because the vendor could not determine what was accessed.
What You Can Do
If you received a notice from Downriver Pediatric Associates, consider these steps:
- Review statements from your healthcare providers and health insurance plan, and contact them right away about any services you did not receive.
- Place a security freeze or fraud alert with Equifax, Experian and TransUnion, including for a minor child where available.
- Request your free annual credit reports at annualcreditreport.com.
- Watch your financial accounts for activity you do not recognize.
- Report suspected fraud to the Federal Trade Commission and your state Attorney General.
- Keep your notification letter and use the practice’s incident response line with questions.
File a Data Breach Lawsuit Against Downriver Pediatric Associates
If you received notice that your information, or your child’s information, may have been exposed in the Downriver Pediatric Associates data breach, you may be entitled to compensation. Healthcare providers that collect sensitive personal and medical information are expected to take reasonable steps to protect it, including when it is held by a vendor, and people affected by a breach can face a lasting risk of identity theft and fraud.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
