Baltimore Medical System Data Breach Affects 197,201 People

Baltimore Medical System, the largest Federally Qualified Health Center (FQHC) in Maryland, experienced a major cyberattack.

On Sept. 16, 2025, the organization was listed as a victim of the Brain Cipher ransomware group on the dark web. According to the threat actor’s posting, sensitive data belonging to the organization was exfiltrated and published on the group’s Tor-based leak site.

BMS later said that between July 2 and July 20, 2025, an unauthorized actor accessed certain systems and accessed or copied certain files. BMS posted notices about the incident on its website on Sept. 26, 2025 and Dec. 10, 2025. It then sent notice letters dated April 2, 2026 to people whose information was involved.

This type of data breach often exposes both personally identifiable information (PII) and protected health information (PHI). Compromised information may include names, contact information, dates of birth, Social Security numbers, driver's license copies or state identification numbers, health insurance information, medical information including diagnosis/treatment information, lab results, medications, payment information, and financial account information.

BMS told the Indiana Attorney General that 197,201 people were affected, including 23 Indiana residents. Massachusetts records show that 12 residents of that state may have been affected. This type of cybersecurity incident increases the risk of identity theft, fraud, and other malicious uses of the leaked information.

The institution has posted a notice of the incident on its website. BMS reported the breach to the U.S. Department of Health and Human Services on Dec. 12, 2025. It also filed notices in Massachusetts and Vermont on April 2, 2026.

Baltimore Medical System's response

Baltimore Medical System is offering affected individuals 12 months of free identity monitoring through Cyberscout, a TransUnion company. People with questions can call 855-522-7641, Monday through Friday from 8 a.m. to 8 p.m. Eastern time, excluding U.S. holidays.

Those who may be affected by this breach should remain vigilant for signs of identity theft or fraud. It is recommended to:

• Carefully review any notice or communication you receive from Baltimore Medical System.
• Monitor financial accounts and credit reports for signs of identity theft.
• Consider placing fraud alerts or credit freezes with the major credit bureaus.
• Be cautious of unsolicited emails or phone calls requesting personal information.