Brown Health Medical Group-MA has confirmed a data breach affecting over 311,000 individuals, exposing personal, medical, and financial information after unauthorized access to a legacy file server. The healthcare provider identified the security incident on December 16, 2025, and an investigation determined that the unauthorized access occurred between December 15 and 16, 2025.
Upon discovery, the organization immediately isolated the compromised server. Brown Health Medical Group-MA explicitly stated that its electronic health record system was not impacted by this incident.
The full scope of potentially exposed data was determined on June 22, 2026. The information that may have been compromised includes demographic details such as names, dates of birth, and contact information. Also at risk were personnel and human resources records, which could include compensation, payroll, licensure, credentialing, and medical or disability-related information. Other sensitive data potentially exposed includes Social Security numbers, driver’s license numbers, other government-issued identification numbers, credit or debit card numbers, and financial account information. Brown Health Medical Group-MA noted that not all categories of information were affected for every individual.
Due to the nature of the incident, the organization was unable to conclusively determine exactly what information was impacted for each individual, leading to notifications being sent out of an abundance of caution.
In response to the breach, Brown Health Medical Group-MA is implementing several measures, including employee retraining and additional security enhancements. The organization is also cooperating with law enforcement authorities in their investigation. Affected individuals are being offered two years of complimentary identity protection and fraud monitoring services through Experian IdentityWorks, and are advised to closely monitor their financial accounts for any suspicious activity.
The breach was reported to the U.S. Department of Health and Human Services, confirming that 311,760 individuals were impacted. As of now, no ransomware group or other threat actor has publicly claimed responsibility for the attack.
