Zumpano Patricios, P.A., a national law firm headquartered in Coral Gables, Florida, experienced a massive data breach affecting 279,275 individuals in the United States. On or about May 6, 2025, ZP Law detected a cyberattack on its network taking place.
The cybersecurity incident compromised both personally identifiable information (PII) and protected health information (PHI). Exposed information includes full names, Social Security numbers, provider names, member ID numbers, health insurer information, dates of service, amounts charged by providers, payment amounts received for services, clinical coding information and medical records.
Zumpano Patricios, P.A. first disclosed the data breach government authorities on July 3, 2025, including to the U.S. Department of Health and Human Services and New Hampshire Attorney General. The firm also published a Notice of Security Incident on its website the same day.
The cyberattack was also reported to the Massachusetts Attorney General's office on July 17, 2025, reporting five residents impacted. The breach is considered severe due to the large number of individuals affected. Legal, health, and financial data are particularly valuable to cybercriminals, increasing the risk of identity theft and other fraudulent activities.
Upon the discovery of the data breach, Zumpano Patricios, P.A. took immediate steps to investigate the incident and secure its systems. In addition to required state and federal disclosures, ZP Law is offering free IDX credit monitoring and identity theft protection services to affected individuals.
If you receive notification from Zumpano Patricios, P.A. or your medical provider about this breach, you may want to:
For more information about the law firm, visit the Zumpano Patricios website.
A breach notice means your personal details could be circulating far beyond the organization involved. One practical step is continuous monitoring: services such as Identity Defender (included with an ExpressVPN subscription) can automatically check dark-web markets, flag new credit-file activity, and request removal of your information from data-broker sites.
This kind of “early-warning system” can’t undo a breach, but it can help you spot misuse quickly and limit further exposure. ExpressVPN is offering 61% off, risk-free for 30 days, with ID Theft Insurance included and no extra cost for those who sign up for one or two years.