Hand & Plastic Surgery Centre Data Breach Exposes PII & PHI

On January 29, 2025, Hand & Plastic Surgery Centre, PLC (H&P), a medical practice located in Grand Rapids, Michigan, discovered that it was the target of a data security incident involving unauthorized access to its computer network. Upon detecting the intrusion, H&P quickly secured its network environment and initiated a comprehensive investigation with the assistance of independent IT security and forensic experts.

The investigation revealed that an unauthorized third party attempted to infiltrate H&P's systems, potentially exposing sensitive personal information of certain individuals. Although investigators found no direct evidence that any individual's information was specifically accessed or misused, the possibility remains that sensitive personal data may have been compromised.

In total, the breach affected approximately 19,846 individuals across the United States, including one individual in Massachusetts. The types of information potentially exposed varied by individual but included PII such as social security numbers and PHI such as medical records.

Hand & Plastic Surgery Centre's Response

Following the discovery of the breach, Hand & Plastic Surgery Centre took immediate steps to secure its network and prevent further unauthorized access. The practice has also implemented additional safeguards and enhanced security measures designed to protect patient information moving forward.

To assist affected individuals, H&P is sending notification letters detailing the incident and providing resources to help protect their personal information. The practice is offering complimentary credit monitoring and identity theft protection services through Cyberscout, a TransUnion company specializing in fraud assistance and remediation services.

Affected individuals are strongly encouraged to enroll in these free credit monitoring and identity theft protection services. Additionally, individuals should remain vigilant by regularly reviewing financial account statements and monitoring free credit reports for suspicious activity. If any unusual or unauthorized activity is detected, individuals should promptly notify their financial institutions and report the activity to local law enforcement and their state's attorney general.

For further guidance on protecting personal information, individuals can visit the Federal Trade Commission's website at IdentityTheft.gov or call 1-877-ID-THEFT (1-877-438-4338).

For more information about this incident, affected individuals can contact H&P directly at 1-855-577-8730, Monday through Friday, from 8:00 a.m. to 8:00 p.m. Eastern Time. Individuals may also visit the practice's dedicated webpage at Elite Plastic Surgery.

Additional Resources and Information

The official disclosure of this data breach is available through the Massachusetts Attorney General's office and the U.S. Department of Health and Human Services.

A detailed notice regarding this incident has also been posted on the Trinity Health Michigan website.

The full text of the consumer notice regarding this data breach is provided at the bottom of this article in PDF format.