Brown Health Medical Group Data Breach Affects Over 311,000 Individuals
Brown Health Medical Group-MA has reported a significant data breach affecting the personal, medical, and financial information of over 311,000 individuals. The breach was detected on December 16, 2025, when the healthcare group identified unauthorized access to a legacy file server that occurred between December 15 and 16. Immediate action was taken to isolate the affected server, and an investigation was launched to assess the extent of the breach. Notably, the incident did not impact the electronic health record system.
On June 22, 2026, the organization determined the potential scope of the exposed data and began notifying affected individuals as a precaution. The notification letter indicated that the compromised information may include personal details such as names, dates of birth, contact information, and government identification numbers, as well as employment records and financial data. However, not all categories of information were affected for every individual.
In response to the breach, Brown Health Medical Group-MA is implementing measures to enhance security, including employee retraining and additional protective measures. The organization is cooperating with law enforcement and has offered affected individuals two years of free identity protection and fraud monitoring services through Experian IdentityWorks. They have also advised individuals to monitor their financial accounts for any suspicious activity.
The breach has been reported to the U.S. Department of Health and Human Services, revealing that 311,760 individuals were impacted. As of now, no ransomware group has claimed responsibility for the attack, leaving the investigation ongoing.
