Mid Florida Dermatology Data Breach Impacts 85,585 Patients

Mid Florida Dermatology & Plastic Surgery, a medical group practice operating 33 offices across central Florida, disclosed a data breach that affected approximately 85,585 individuals in the United States.

The company reported the breach to the U.S. Department of Health and Human Services on May 1, 2026. Mid Florida Dermatology & Plastic Surgery discovered the breach on March 30, 2026, and posted a notice on its website with details about the incident and resources available to those who may have been affected.

Between March 26 and March 30, 2026, an unauthorized party gained access to and/or acquired personal information stored within the company's systems.

An investigation into the incident determined that both personal and medical data had been compromised during the period of unauthorized access.

On April 25, 2026, a ransomware group known as Qilin publicly claimed responsibility for the attack. The group posted on the dark web stating it had obtained the organization's data.

The types of information exposed included both personally identifiable information (PII) and protected health information (PHI).

The PII compromised included names, addresses, dates of birth, passport numbers, Social Security numbers, driver's license numbers, Medicare numbers, other government identification numbers, financial account numbers and financial account access information.

The PHI compromised included health insurance information and medical information.

Mid Florida Dermatology & Plastic Surgery's response to the breach

Mid Florida Dermatology & Plastic Surgery mailed notice letters to individuals whose information was potentially impacted by the breach.

The company also established a dedicated call center for individuals who have questions about the incident or need additional guidance. The call center can be reached at 1-877-347-1436 and is available Monday through Friday between 9 a.m. and 9 p.m. Eastern Time.

The company encouraged individuals to review their account statements and credit reports closely for any unauthorized activity and to report any suspicious transactions to their financial institutions.