Zumpano Patricios, P.A., a national law firm headquartered in Coral Gables, Florida, experienced a massive data breach affecting 279,275 individuals in the United States. On or about May 6, 2025, ZP Law detected a cyberattack on its network taking place.
The cybersecurity incident compromised both personally identifiable information (PII) and protected health information (PHI). Exposed information includes full names, Social Security numbers, provider names, member ID numbers, health insurer information, dates of service, amounts charged by providers, payment amounts received for services, clinical coding information and medical records.
Zumpano Patricios, P.A. disclosed the data breach to the U.S. Department of Health and Human Services on July 3, 2025 and published a Notice of Security Incident on its website the same day. Affected individuals are being notified.
The cyberattack was also reported to the Massachusetts Attorney General's office on July 17, 2025, reporting five residents impacted. The breach is considered severe due to the large number of individuals affected. Legal, health, and financial data are particularly valuable to cybercriminals, increasing the risk of identity theft and other fraudulent activities.
Upon the discovery of the data breach, Zumpano Patricios, P.A. took immediate steps to investigate the incident and secure its systems. In addition to required state and federal disclosures, ZP Law is offering free IDX credit monitoring and identity theft protection services to affected individuals.
If you receive notification from Zumpano Patricios, P.A. or your medical provider about this breach, you may want to:
For more information about the law firm, visit the Zumpano Patricios website.