Mid Florida Dermatology & Plastic Surgery Data Breach Affects 85K Patients

Posted by Steve Alder

Data breaches have been announced by Mid Florida Dermatology & Plastic Surgery, Kannarr Eye Care in Kansas, and Indiana University Health Affiliated Covered Entity.

Mid Florida Dermatology & Plastic Surgery

Mid Florida Dermatology & Plastic Surgery, a medical group with 33 locations in central Florida, has notified the HHS’ Office for Civil Rights about a data breach affecting 85,585 individuals. According to a September 10, 2026, notice on the medical group’s website, unusual activity was identified within its computer systems on March 30, 2026. The forensic investigation determined that an unauthorized third party had access to its network from March 26, 2026, to March 30, 2026, during which time files containing patient data may have been viewed or acquired.

The data review determined that the information potentially accessed or obtained included names, addresses, dates of birth, passport numbers, Social Security numbers, driver’s license numbers, Medicare numbers, other government identification numbers, financial account numbers, financial account access information, health insurance information, and medical information. The types of information involved varied from individual to individual. Mid Florida Dermatology & Plastic Surgery said it is reviewing its security policies and procedures and is taking steps to reduce the risk of similar incidents in the future.

Kannarr Eye Care

Kannarr Eye Care, an optometry practice based in Pittsburg, Kansas, has identified unauthorized access to its computer systems. The incident was identified on March 30, 2026, and the forensic investigation determined that an unauthorized third party accessed or acquired files containing patients’ personal and protected health information.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

A review of the affected data was completed on August 17, 2026, confirming that names, Social Security numbers, and health insurance information were involved. Kannarr Eye Care has enhanced its security measures, implemented additional technical safeguards, and strengthened its policies and procedures related to data privacy and security to reduce the risk of similar incidents in the future. Notification letters were mailed to the affected individuals on September 17, 2026. The data breach was reported to the HHS’ Office for Civil Rights as affecting 14,003 individuals.

Indiana University Health, Affiliated Covered Entity

Indiana University Health Affiliated Covered Entity, has disclosed a security incident that has affected 2,080 individuals. The incident involved one of its vendors, AME Group. AME Group provides information technology services for an isolated IU Health legacy system. IU Health learned on August 4, 2026, that a previously unknown security vulnerability was susceptible to exploitation. Steps were immediately taken to verify the security of its systems, and while it was established that its core systems and electronic medical records were unaffected, a review of AME’s external vendor-managed system confirmed that there had been unauthorized access to limited imaging center information related to patients in Southern Indiana.

The information involved varied from individual to individual and may have included names, birth dates, health plan ID numbers, and limited treatment information related to the imaging center. The affected individuals were notified on September 29, 2026.

The post Mid Florida Dermatology & Plastic Surgery Data Breach Affects 85K Patients appeared first on The HIPAA Journal.

$6.4 Million Settlement Agreed in AMCA Customer Data Breach Litigation

Posted by Steve Alder

A settlement has been agreed to partly resolve litigation stemming from a cyberattack on American Collection Medical Agency (AMCA).  The settlement resolves the “Other Labs Track” of the litigation and has been agreed to by the plaintiffs and AMCA clients Sonic Healthcare U.S.A., Aurora Diagnostics LLC, Clinical Pathology Laboratories, Inc., and Austin Pathology Associates. The defendants have agreed to pay $6,438,578.20 to resolve all claims against them related to the AMCA data breach.

AMCA, a subsidiary of Retrieval-Masters Creditors Bureau, Inc., specializes in recovering small-balance medical debt for clinical laboratories and healthcare providers. The company identified a cyberattack on March 30, 2029, and the forensic investigation determined that an unauthorized third party had access to sensitive data between August 1, 2018, and March 30, 2019, following an attack on AMCA’s web payment portal. Data compromised in the incident included names, contact information, government-issued identifiers, medical billing information, financial account and payment information. More than 27 million individuals are believed to have been affected in total.

Many lawsuits were filed against AMCA and its clients in response to the data breach, asserting claims for negligence, breach of contract, and other claims. The lawsuits were consolidated in the U.S. District Court for the District of New Jersey, and after six years of hard-fought litigation, the defendants on this track – In Re: American Medical Collection Agency, Inc. Customer Data Security Breach Litigation (All Actions Against Other Labs Track) – have agreed to a settlement to avoid further litigation costs and the uncertainty of a trial and any associated appeals. The defendants continue to deny wrongdoing and liability and maintain that the plaintiffs and class members have not suffered any injury or damage as a result of the cyberattack or data breach.

The defendants have agreed to establish a $6,438,578.20 settlement fund to cover all costs and expenses related to the litigation, including attorneys’ fees and expenses, settlement administration and notice costs, service awards for the class representatives, and claims from the class members. Class members are entitled to claim two years of medical and health information monitoring through the CyEx Medical Shield Pro service. In addition, a claim may be submitted for compensation for documented, unreimbursed out-of-pocket losses due to the data breach up to a maximum of $5,000 per class member, which may include up to 10 hours of documented lost time at $25 per hour.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Class members who choose not to submit a claim for compensation of losses and/or lost time may choose to receive a one-time cash payment, the value of which will depend on the claims received, but has been estimated to be approximately $50. The important dates for class members are a deadline of December 3, 2026, for objecting to and opting out of the settlement, and January 4, 2027, for submitting a claim. The final fairness hearing has been scheduled for January 7, 2026.

The post $6.4 Million Settlement Agreed in AMCA Customer Data Breach Litigation appeared first on The HIPAA Journal.

Ransomware Groups Increasingly Resorting to Real World Threats

Posted by Steve Alder

The tactics of ransomware groups are constantly changing to increase pressure on victims to give in to their demands. Initially, file encryption alone was sufficient; however, as victims improved cyber resilience and were able to recover their encrypted files from backups, tactics had to evolve. Ransomware groups incorporated data theft into their attacks and started threatening to sell or leak the stolen data if the ransom was paid. This double extortion approach proved highly successful, with the threat of a data leak alone sufficient to prompt many victims to pay up.

Encryption and data leak threats are no longer enough, as the percentage of victims paying ransoms continues to fall. According to a recent survey commissioned by the Identity Threat Detection and Response (ITDR) firm Semperis, the percentage of ransomware victims paying ransoms has fallen from 78% in 2024 to 69% in 2025, and 59% in 2026.

Ransomware groups have responded by adopting more aggressive tactics, and a trend has emerged of ransomware groups issuing personal threats against company employees and their friends and family members. The survey revealed that 37% of ransomware attacks involved threats against friends or family members of staff members, and 41% of respondents to the survey said they had been a target of physical or psychological intimidation.

While contacting individuals whose data was stolen in an attack has been adopted by several groups in the past, the threats have generally been limited to the publication of personal data, but threats are becoming more severe. Ransomware groups are now issuing threats of physical violence and are contacting employees and their friends and family members via text, email, or phone, confirming that they know where they live, work, and even where their children go to school.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The threat of data erasure, destruction, and publication remains the most common tactic (56%), followed by blackmail/extortion (41%), and system lockouts or sabotage (40%); however, 23% of malicious actors have resorted to psychological intimidation, 17% are issuing physical threats, and in 10% of cases, have threatened legal exposure. Semperis warns in its third annual ransomware report that personal threats are gaining more traction. Out of the individuals who received personal threats, 57% received threatening texts, letters, or packages, 37% received threats about friends and family members, 19% were threatened with physical intrusion, 17% with abduction, 13% with bodily harm, and 6% with stalking.

Semperis said that in 53% of cases, the attackers followed through on their threats. There have been cases of doxxing – exposing personal information – and swatting – triggering an armed police response to a reported threat – which can push victims into ransom negotiations. About 25% of victims reported doxxing, and 23% experienced swatting, according to the survey.

The impact on the individuals concerned has been severe, with around a quarter of the targeted individuals requiring medical or mental health care, and 14% stating they have been forced to change jobs, offices, or homes as a result. Semperis suggests that companies need to respond to these modern threat tactics and should incorporate procedures into their ransomware resilience strategies, including how to respond to attacks involving threats to individuals outside of the organization.

“I’ve spoken with CISOs that had strong relationships with law enforcement,” said Courtney Guss, AVP of Crisis Management, Semperis. “They’ve found it to be a much faster route to information and resources than they would otherwise have found on their own, which can often help them recover more quickly. So, knowing those contacts and building those relationships in advance should be part of your crisis management plan.” Semperis also recommends strengthening identity resilience, preparing for identity system breaches, and practicing incident response procedures time and again against realistic scenarios, including tabletop exercises involving all team members involved in the ransomware response.

The post Ransomware Groups Increasingly Resorting to Real World Threats appeared first on The HIPAA Journal.