Mid Florida Dermatology & Plastic Surgery breach hits 85K; Kannarr Eye Care and IU Health vendor AME Group also report incidents
Mid Florida Dermatology & Plastic Surgery, a 33-location medical group in central Florida, reported to the HHS Office for Civil Rights a breach affecting 85,585 individuals. An unauthorized third party accessed its network from March 26 to March 30, 2026, and patient files may have been viewed or acquired. Two other healthcare incidents were disclosed alongside it: Kannarr Eye Care in Kansas (14,003 individuals) and Indiana University Health Affiliated Covered Entity (2,080 individuals), the latter via its IT vendor AME Group. The article does not name any threat actor or malware for these incidents.
Technical Details
- Mid Florida Dermatology & Plastic Surgery: unusual activity was detected on March 30, 2026. Exposed data may include names, addresses, dates of birth, passport numbers, Social Security numbers, driver's license numbers, Medicare numbers, other government ID numbers, financial account numbers and access information, health insurance information and medical information. The notice was posted September 10, 2026.
- Kannarr Eye Care (Pittsburg, Kansas): the incident was identified March 30, 2026. The data review, completed August 17, 2026, confirmed exposure of names, Social Security numbers and health insurance information. Notification letters were mailed September 17, 2026.
- IU Health / AME Group: on August 4, 2026, IU Health learned that a previously unknown vulnerability in a vendor-managed, isolated legacy system was susceptible to exploitation. Unauthorized access to limited imaging center data for patients in Southern Indiana was confirmed. Core systems and electronic medical records were not affected. Exposed data may include names, birth dates, health plan ID numbers and limited treatment information. Individuals were notified September 29, 2026.
Remediation
The affected organizations report reviewing security policies and procedures, enhancing security measures and adding technical safeguards. Defenders in healthcare should audit third-party and legacy vendor-managed systems and make sure they are patched and segmented. Affected individuals should act on the notification letters they receive.
Linha do tempo
-
Mid Florida Dermatology & Plastic Surgery breach hits 85K; Kannarr Eye Care and IU Health vendor AME Group also report incidents
ler a análise desta fonte ocultar
Mid Florida Dermatology & Plastic Surgery, a 33-location medical group in central Florida, reported to the HHS Office for Civil Rights a breach affecting 85,585 individuals. An unauthorized third party accessed its network from March 26 to March 30, 2026, and patient files may have been viewed or acquired. Two other healthcare incidents were disclosed alongside it: Kannarr Eye Care in Kansas (14,003 individuals) and Indiana University Health Affiliated Covered Entity (2,080 individuals), the latter via its IT vendor AME Group. The article does not name any threat actor or malware for these incidents.
Technical Details
- Mid Florida Dermatology & Plastic Surgery: unusual activity was detected on March 30, 2026. Exposed data may include names, addresses, dates of birth, passport numbers, Social Security numbers, driver's license numbers, Medicare numbers, other government ID numbers, financial account numbers and access information, health insurance information and medical information. The notice was posted September 10, 2026.
- Kannarr Eye Care (Pittsburg, Kansas): the incident was identified March 30, 2026. The data review, completed August 17, 2026, confirmed exposure of names, Social Security numbers and health insurance information. Notification letters were mailed September 17, 2026.
- IU Health / AME Group: on August 4, 2026, IU Health learned that a previously unknown vulnerability in a vendor-managed, isolated legacy system was susceptible to exploitation. Unauthorized access to limited imaging center data for patients in Southern Indiana was confirmed. Core systems and electronic medical records were not affected. Exposed data may include names, birth dates, health plan ID numbers and limited treatment information. Individuals were notified September 29, 2026.
Remediation
The affected organizations report reviewing security policies and procedures, enhancing security measures and adding technical safeguards. Defenders in healthcare should audit third-party and legacy vendor-managed systems and make sure they are patched and segmented. Affected individuals should act on the notification letters they receive.