Brevard Skin and Cancer Center Announces September Cyberattack
Brevard Skin and Cancer Center, a dermatology practice in Brevard, Florida, has fallen victim to a cyberattack that was first identified on October 14, 2025. Immediate action was taken to secure its systems, and third-party cybersecurity experts were engaged to investigate the nature and scope of the unauthorized activity. The forensic investigation confirmed that an unauthorized third party first gained access to its network on September 28, 2025, and accessed and exfiltrated certain files from its network. Brevard Skin and Cancer Center has been reviewing the affected files to determine the types of data involved and the individuals affected, and can now confirm that the personal and protected health information of current and former patients was involved.
The affected data varies from individual to individual and may include names in combination with one or more of the following: date of birth, home address, Social Security number, phone number, diagnosis and clinical information, e-mail address, and billing and claims information. Employee data was also compromised in the incident, including full names, phone numbers, dates of birth, home addresses, Social Security numbers, health conditions included in FMLA forms, and e-mail addresses.
Brevard Skin and Cancer Center is evaluating its cybersecurity measures and is reviewing security policies and procedures, and steps are being taken to strengthen security to prevent similar data breaches in the future. Notification letters have been mailed to the affected individuals, and complimentary credit monitoring and identity theft protection services have been made available for 24 months.
The breach notifications do not mention the hacking group involved; however, the Pear threat group has claimed responsibility for the attack and claims to have exfiltrated 1.8 terabytes of data. Pear is a new hacking group that emerged in August 2025, which does not encrypt data, instead it specializes in pure exfiltration and ransom. The group has been highly active and has conducted several attacks on the healthcare sector in recent months. There have been at least 49 attacks conducted by the group in the past three months.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
