Advanced Medical Management breach exposed data on 319,485 people

Advanced Medical Management, a Baltimore company that provides operational, administrative and technical services to large physician organizations, government agencies and health plans, reported a data breach affecting 319,485 individuals. The company detected the intrusion on May 11, 2023 and determined that an unauthorized party had access to its network between May 10 and May 13, 2023.

In its breach notice, Advanced Medical Management said the affected portions of its IT network had been designed and maintained by third-party vendors and were accessible to an unauthorized party. The company did not name the vendors involved.

A forensic investigation established which records had been exposed. The affected files contained names, addresses, email addresses, telephone numbers, dates of birth, driver's license numbers, Social Security numbers and health insurance information. A class action complaint filed afterwards described the compromised material as also including treatment and diagnosis details, provider names, dates of service and policy numbers.

Notification letters began going out on June 29, 2023, about seven weeks after detection. Litigation followed quickly. The first proposed class action, which accused the company of inadequate cybersecurity, was voluntarily dismissed in August 2023, and a related case was later resolved with a $2.5 million settlement.