Notifications Issued About MedStar Health Data Breach
MedStar Health, a non-profit health system that operates 10 hospitals in the Baltimore-Washington metropolitan area, has recently disclosed a cyberattack and data breach that was first identified on October 4, 2025. The forensic investigation confirmed that an unauthorized third party gained access to certain internal systems that contained patient data between September 12, 2025, and September 16, 2025.
The files accessed in the attack were reviewed, and on November 12, 2025, MedStar Health confirmed that the compromised files contained patient data, including names, dates of birth, Social Security numbers, and potentially diagnoses, medications, test results, images, health insurance, and treatment information. MedStar Health said that prior to the attack, physical, technical, and administrative safeguards had been implemented to safeguard patient data. On this occasion, they failed to detect and block the attack. MedStar Health said it continuously evaluates its cybersecurity measures and will continue to do so in the future.
On December 3, 2025, notification letters started to be mailed to the affected individuals. As a precaution against identity theft and fraud, the affected individuals have been offered complimentary credit monitoring and identity theft protection services. The affected individuals are advised to take advantage of those services and monitor their accounts and explanation of benefits statements closely.
While not mentioned in the notification letters, the Rhysida threat group has claimed responsibility for the attack. Rhysida is well known for stealing and selling stolen data if the ransom is not paid. Any data not sold is then listed on its dark web data breach portal. Rhysida claims to have exfiltrated 3.7 Tb of data, including more than 1,.8 million files, and “over 7 million pieces of patient data”, and claims to have leaked that data on its dark web data leak site.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
