Mid Florida Dermatology & Plastic Surgery has told the public that certain information may have been copied without authorization from its digital environment.
Here is what the practice and federal records say so far, and what you can do if you were a patient.
Mid Florida Dermatology & Plastic Surgery’s Data Breach Investigation
Mid Florida Dermatology & Plastic Surgery is a medical practice that provides dermatology, plastic surgery and allergy care at several locations in Central Florida. In a public notice dated September 10, 2026, the practice said it had experienced a cyber incident and described what it knows about the event, its response and the resources available to people who may be affected.
According to that notice, the practice became aware of unusual activity in its digital environment on March 30, 2026. It began an investigation and retained outside experts. The investigation found that certain information may have been copied without authorization between March 26, 2026 and March 30, 2026. The practice then started a detailed review of the affected data set to work out what sensitive information was involved and whose it was, and it says it finished that review on August 31, 2026.
Federal records add to the picture. The U.S. Department of Health and Human Services Office for Civil Rights lists a report from the practice, submitted on May 1, 2026, that describes a hacking or IT incident involving a network server and reports that 85,585 individuals were affected. The practice’s own notice does not state a total, so this page uses the figure from the federal listing and attributes it to that source.
The timeline here is long, and it is worth reading closely. The unusual activity ended on or about March 30, 2026, but the practice reports that it did not finish its review of the affected files until August 31, 2026, and its public notice is dated September 10, 2026. Large file reviews take time, because analysts must open the files, find the personal information in them and match it to individuals before letters can go out. For patients, however, that can mean many months between the incident and the first warning.
The practice says it is mailing notice letters to people whose information was found in the affected files and for whom it has a valid mailing or email address. It adds that anyone who does not receive a letter but wants to know whether they are affected can call a dedicated assistance line listed in its notice. If you were a patient of the practice, or you worked with it, it is reasonable to call even if no letter has arrived yet.
The practice states that it is reviewing and enhancing its policies and procedures related to data privacy to reduce the likelihood of a similar incident. The notice does not describe the specific technical cause, does not say whether a ransomware or extortion demand was made, and does not name the people responsible. This page does not speculate on any of those points.
The list of information that may have been involved is long, and it varies from person to person. Some categories, such as a passport number, a Medicare number, a financial account number and the details needed to log in to a financial account, are the kind of data that can be misused in ways that go well beyond a single fraudulent card charge. When health insurance details and medical information are exposed along with an identity number, the combination can be used for medical identity theft, such as filing false claims in someone else’s name.
Dermatology and plastic surgery practices also tend to hold sensitive visit details, such as treatment histories and billing records. The practice’s notice does not say that photographs or treatment records were involved, and this page does not claim they were. Your own notice letter is the best guide to the information that applies to you, because the practice says the potentially affected information varied by individual.
If you receive a letter, keep it and its envelope, note the date it arrived, and read it for the specific data elements that apply to you. Be cautious of calls, texts and emails that mention this incident and ask for personal details, since scammers often follow publicized breaches. If you are unsure whether a message is genuine, contact the practice using the phone number published on its own website rather than one provided in the message.
When Did This Breach Occur?
The practice says it became aware of unusual activity on March 30, 2026, and that information may have been copied without authorization between March 26, 2026 and March 30, 2026.
It finished reviewing the affected data on August 31, 2026, posted its public notice on September 10, 2026, and had reported the incident to federal regulators on May 1, 2026.
What Information Was Breached?
According to the practice, the potentially impacted information varied by individual and may include name, address, date of birth, passport number, Social Security number, driver’s license number, Medicare number, other government identification number, financial account number, financial account access information, health insurance information and medical information.
Not every person had every category involved. Your notice letter should say what applies to you.
What You Can Do
If you received a notice related to Mid Florida Dermatology & Plastic Surgery or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- If you do not receive a letter but think you may be affected, call the practice’s dedicated assistance line listed in its notice.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Mid Florida Dermatology & Plastic Surgery
If your personal information was exposed in this incident, you may have legal options. Organizations are expected to protect the sensitive information they are trusted with, and a class action can help hold them accountable when security falls short.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
