Facial Surgery Group Data Breach Affects 11,407 Patients

Facial Surgery Group, an oral and maxillofacial surgery practice serving the Kansas City area, disclosed a data breach that affected 11,407 individuals in the United States.

The breach was disclosed to the U.S. Department of Health and Human Services on March 27, 2026, and to the Massachusetts Office of Consumer Affairs and Business Regulation on Oct. 20, 2026. The company also posted a data security notice on its website.

On Nov. 24, 2025, Facial Surgery Group detected suspicious activity within its email environment. Upon discovery, the company disabled the affected email account, changed the account password and terminated active sessions. Facial Surgery Group then engaged a specialized third-party cybersecurity firm and IT personnel to conduct an investigation.

The investigation concluded on Feb. 2, 2026, and determined that there was potential unauthorized access to certain information contained in an employee's email account. To identify whose information was involved and what types of data were affected, the company then conducted a review which completed on Sept. 9, 2026.

The types of consumer information that may have been exposed included names, dates of birth, Social Security numbers, demographic information, financial account numbers and health information such as medical record numbers, patient account numbers, Medicaid numbers, health insurance group numbers, medical diagnosis information, medical treatment and procedure information, treatment locations, clinical information and provider names.

Facial Surgery Group's response to the breach

Facial Surgery Group is offering affected individuals 24 months of single bureau credit monitoring, single bureau credit report and single bureau credit score services at no charge. Affected individuals must enroll within 90 days of the date of the notification letter.

The company also set up a toll-free call center for affected individuals with questions or concerns. The call center is available Monday through Friday from 9:00 a.m. to 9:00 p.m. Eastern Standard Time, excluding U.S. national holidays.