2026 Brown Health Medical Group-MA — HHS OCR 311,760; Dec 2025 Hawthorn file-server theft
Data compromised
Names, contact information, DOB, SSNs, driver’s license / government ID numbers, medical and disability-related records, financial account information, credit/debit card numbers; also personnel/HR records including payroll/compensation and licensure/credentialing for some individuals (not all categories for all people). HHS OCR: 311,760 individuals (290,357 Massachusetts residents).
Technical writeup
Verified healthcare breach with HHS OCR headcount — Lifespan Physician Group of Massachusetts, Inc. d/b/a Brown Health Medical Group-MA notified individuals after attackers accessed a historic file server at its Hawthorn location in December 2025 (EHR unaffected). The practice determined on June 22, 2026 that personal information was accessed. Sample MA OCA notice and SecurityWeek (Aug 2026) list names, contacts, DOB, SSNs, DL/government IDs, medical/disability records, financial accounts, payment cards, and some HR/payroll/credentialing data. HHS OCR lists 311,760 affected individuals, including 290,357 Massachusetts residents; Vermont AG materials previously cited additional VT residents. Two years of fraud/identity monitoring offered. Threat actor not named. recordsAffected updated from earlier MA-only 290,357 floor to OCR’s 311,760.
Root cause
Attackers stole files from a historic file server at the Hawthorn location in December 2025; EHR not affected. Practice determined June 22, 2026 that attackers accessed files containing personal information (SecurityWeek / MA OCA sample notice).
References
- https://www.mass.gov/doc/data-breach-report-2026/download
- https://ago.vermont.gov/categories/security-breach-notices
- https://www.classaction.org/data-breach-lawsuits/brown-health-medical-group-ma-july-2026
- https://abingtonlaw.com/class-action/data-breach/Brown-Health-Medical-Group-data-breach-class-action-lawsuit.html
- https://www.securityweek.com/311000-impacted-by-brown-health-medical-group-ma-data-breach/
- https://www.mass.gov/doc/2026-1151-lifespan-physician-group-of-massachusetts-inc-dba-brown-health-medical-group-ma/download
- https://ocrportal.hhs.gov/ocr/breach/breach_report_hip.jsf
- https://www.bostonglobe.com/2026/08/06/metro/brown-lifespan-medical-data-breach-massachusetts-vermont/
- https://securityaffairs.com/196681/uncategorized/brown-health-medical-group-ma-data-breach-exposes-information-of-311000-individuals.html