Personal and Medical Records of 160,312 Americans Potentially Exposed After Major Data Breach Hits Healthcare Firm

Southern Illinois Dermatology reported a hacking incident affecting 160,312 individuals to the U.S. Department of Health and Human Services Office for Civil Rights. The breach involved a network server and was discovered in November 2025, with an unauthorized third party potentially accessing or acquiring files in March. The compromised data may have included names, addresses, dates of birth, Social Security numbers, phone numbers, email addresses, and medical record numbers. The company launched an investigation with third-party cybersecurity specialists and has taken steps to strengthen its cybersecurity practices. Notification letters began going out on April 2, 2026, and a threat group claimed responsibility, posting sample data online. At the time of notice, there was no indication of identity theft or fraud resulting from the incident. The investigation confirmed unauthorized access to parts of the network where patient data was stored, and files may have been copied. The company notified consumers in April about the breach.