Brown Health Medical Group-MA suffered a data breach involving unauthorized access to a historic file server at its Hawthorn location. The breach compromised personal information such as names, contact details, dates of birth, Social Security numbers, driver’s license numbers, government ID numbers, medical and disability records, financial account information, credit/debit card numbers, personnel and human resources records, and licensure or credentialing information. The breach was identified in June 2026, although the incident occurred in December 2025. The organization isolated the affected server and enhanced security measures, including employee retraining. No ransomware or extortion group has claimed responsibility, and the electronic health record system was not impacted.

The breach exposed sensitive personal, medical, and financial information of over 311,000 individuals, including nearly 290,000 Massachusetts residents. This exposure increases the risk of identity theft, financial fraud, and privacy violations for the affected individuals. The compromise of personnel and credentialing information may also have internal organizational impacts. However, the electronic health record system was not affected, limiting the scope of clinical data exposure.

Brown Health Medical Group-MA has isolated the affected server and implemented additional safeguards. The organization is retraining employees to prevent future incidents and is providing two years of free fraud detection and identity protection services to affected individuals. No further immediate action is indicated based on the available information. Patch status is not applicable as this is a breach incident rather than a software vulnerability.