Affiliated Dermatologists breach hit about 380,000 patients and staff

Affiliated Dermatologists & Dermatologic Surgeons, a multi-site practice based in Morristown, New Jersey, reported a ransomware intrusion affecting roughly 380,000 patients and employees. Staff found a ransom note on the practice's network on 5 March 2024 and called in the practice's third-party IT provider along with outside cybersecurity specialists.

The investigation determined that an unauthorized party had been inside the network between 2 and 5 March 2024 and had copied files. On 10 April 2024 the practice confirmed that those files contained personal information belonging to patients and employees.

For patients, the exposed data could include names, dates of birth, mailing addresses, Social Security numbers, medical treatment information and health insurance claims information. Employee records could additionally include driver's license numbers and passport numbers. The incident was reported to the US Department of Health and Human Services Office for Civil Rights as affecting up to 380,000 individuals.

The practice said it reset passwords across the network, added multi-factor authentication for remote access and put round-the-clock network monitoring in place. It began mailing individual notification letters describing the specific data involved for each recipient and offered complimentary credit monitoring and identity theft protection. The practice said it was not aware of any misuse of the information. Several US law firms announced class action investigations in the weeks after the notice.