Facial Surgery Group, PC has notified patients of a data security incident involving an employee email account. The practice says information such as medical record numbers, Medicaid numbers, and diagnosis and treatment details may have been accessed. Health care providers are responsible for protecting the records patients entrust to them.
Facial Surgery Group’s Data Breach Investigation
Facial Surgery Group, PC, which its notice calls Facial Surgery Group, is a surgical practice that sent patients a Notice of Data Incident in a letter dated October 16, 2026. The notice was handled through HaystackID, a vendor that runs return processing and fraud assistance for the mailing. A copy of the letter was filed with Massachusetts regulators, which is how the incident became public.
According to the letter, Facial Surgery Group detected suspicious activity within its email environment on November 24, 2025. The practice says it immediately disabled the affected email account, changed the password, ended active sessions and brought in an outside cybersecurity firm and IT personnel to carry out a forensic investigation. Those are standard first steps after an email compromise, and they matter because a stolen login can otherwise keep working.
The forensic investigation concluded on February 2, 2026. It found potential unauthorized access to certain information contained in one employee’s email account. The letter uses the word potential, which means the investigators could not rule out that the information was viewed or copied. The practice states that it has no evidence that any sensitive information has been misused by third parties as a result of the incident.
Learning what was in the mailbox took a second step. Facial Surgery Group says it hired a third-party data mining vendor to work out whose information was in the account and what kind of information it was. That review was completed on September 9, 2026. The notice letters are dated October 16, 2026, which is more than ten months after the suspicious activity was first detected.
That timeline is common in email incidents. Mailboxes collect years of attachments and messages, and sorting through them to find every patient name and record number is slow work. For the people affected, though, it means the period between the incident and the notice was long, and anyone who sat in that mailbox may have been exposed for most of a year without knowing it.
The letter lists the information that may have been subject to unauthorized access, and the list is medical in nature: date of birth, medical record number, patient account number, Medicaid number, health insurance group number, medical diagnosis information, medical treatment or procedure information, treatment location, clinical information and provider name. Not every person will have had every item involved, and each individual letter is the best guide to what applies to that person.
The filing does not say how many people received the notice. Facial Surgery Group did not publish a total in the letter, and this page does not estimate one. The letter does state that no Rhode Island residents were potentially impacted, and it includes state-specific notices for readers in several other states, which suggests patients or others in more than one state may have been contacted.
As a response to the incident, the practice says it engaged external cybersecurity experts to assess and strengthen its accounts, improve monitoring and access controls and put additional safeguards in place. It is also offering single bureau credit monitoring, a single bureau credit report and a credit score at no charge, with alerts for 24 months from the date of enrollment, plus fraud assistance through HaystackID. People must enroll within 90 days of the date of the letter.
The mix of data in this incident is different from a typical financial breach. A Social Security number is not listed in the letter, but a Medicaid number, an insurance group number and a medical record number can still be used for medical identity theft, such as billing for care in someone else’s name. Diagnosis and treatment details can also make scam calls and messages more convincing, because they mention something that sounds like real knowledge of a person’s care. This is general industry context and not a finding about any specific person.
Several questions remain open in the public record, including how many patients were affected, how the email account was first accessed and whether any of the data has been misused. Anyone who received a letter from Facial Surgery Group should keep it, enroll in the offered services if they wish, and read it closely, because the details in that letter will control over anything general written here.
When Did This Breach Occur?
Facial Surgery Group says it detected suspicious activity in its email environment on November 24, 2025. The forensic investigation concluded on February 2, 2026, and the review of the affected account to identify individuals was completed on September 9, 2026. The notice letters are dated October 16, 2026.
What Information Was Breached?
According to the letter, the information that may have been accessed includes date of birth, medical record number, patient account number, Medicaid number, health insurance group number, medical diagnosis information, medical treatment or procedure information, treatment location, clinical information and provider name.
The practice says the information involved varied by person and that it has no evidence of misuse.
What You Can Do
If you received a notice related to Facial Surgery Group or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the free credit monitoring offered in your letter within 90 days of its date, and review explanation-of-benefits statements from your insurer or Medicaid for services you did not receive.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Facial Surgery Group
If you were notified that your medical, insurance or treatment information was exposed in the incident involving Facial Surgery Group, you may have legal options. Health care providers are expected to safeguard patient information, and a class action can help hold them accountable when they fall short.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
