Brown Health reports 311,000 breach

Brown Health Medical Group-MA says a cyberattack on a legacy file server exposed personal, medical and financial information tied to more than 311,000 people. The organization said it discovered the incident on December 16, 2025, and later determined unauthorized access occurred between December 15 and 16. (hawthornmed.com) A substitute notice posted July 16, 2026 said the affected system was a “historic file server” at its Hawthorn location, and that the electronic medical record system was not involved. The U.S. Department of Health and Human Services breach portal now lists 311,784 people as affected. (ocrportal.hhs.gov) ### Which part of Brown Health was hit? Lifespan Physician Group of Massachusetts, Inc., which does business as Brown Health Medical Group-MA, said the incident involved its Hawthorn location. (hawthornmed.com) The substitute notice says the organization isolated the affected server after discovering the breach and hired third-party specialists to investigate. Hawthorn Medical is a multi-specialty physician group in Massachusetts. The public notice says the intrusion was limited to a file server and did not affect the practice’s electronic medical record environment. (hawthornmed.com) ### What information was exposed? Brown Health said the exposed files may have included names, dates of birth, addresses, Social Security numbers, driver’s license numbers, financial account information, payment card information, medical record numbers, health insurance information and treatment information. The company said the exact data elements varied by individual. (hawthornmed.com) SecurityWeek reported that the compromised data covered personal, medical and financial information of patients and staff. That report cited the same public notice and the federal breach filing. (hawthornmed.com) ### Why did the number rise above 311,000? The HHS Office for Civil Rights breach portal lists Brown Health Medical Group-MA with 311,784 affected individuals. SecurityWeek reported the total as more than 311,000 after the federal filing appeared this week. HIPAA Journal, citing the organization’s notice, reported the incident as affecting nearly 312,000 people. The difference appears to reflect rounding in secondary reports versus the exact figure shown on the federal portal. (hawthornmed.com) That is an inference based on the two published totals. ### When did Brown Health notify people? The substitute notice is dated July 16, 2026, roughly seven months after the company said it discovered the intrusion. (securityweek.com) The notice says Brown Health mailed letters to people for whom it had valid addresses and posted a substitute notice for others. The HHS breach portal says reports affecting 500 or more people are posted by the Office for Civil Rights while under investigation. (ocrportal.hhs.gov) HHS says OCR investigates such breaches under federal health privacy rules. ### What is Brown Health offering affected people now? Brown Health said it is offering complimentary credit monitoring and identity theft protection services to eligible individuals. (hipaajournal.com) The substitute notice directs affected people to review the mailed notice or the public posting for enrollment details and recommended steps such as monitoring account statements and credit reports. (hawthornmed.com) The Hawthorn Medical substitute notice remains the company’s public reference point for the breach, including contact information and next-step guidance. The HHS listing also remains public while the case is under investigation by the Office for Civil Rights. (hawthornmed.com) (ocrportal.hhs.gov)