Medical Associates of Brevard notifies 246,711 patients after cyberattack

Medical Associates of Brevard (MAB) notified 246,711 patients after a cyberattack, with the incident details first appearing when the Bian Lian ransomware gang added MAB to its dark web leak site on 23 January 2025. According to their submission to the Maine Attorney General’s Office, the incident occurred on 7 January 2025, though the substitute notice to affected individuals does not reveal the date.

The notice promises at least 12 months of free credit monitoring and related services, and MAB does not disclose whether data was leaked or misused. MAB operates six locations in Brevard County, Florida, and DataBreaches notes questions about why so much protected health information was stored seemingly without encryption.

DataBreaches expects that the HHS OCR or other investigations will probe MAB’s assessment and security for such data, including whether there were sufficient access logs, and whether expert dark web monitoring was conducted. DataBreaches also questions how MAB determined who was potentially affected and whether they continued searches over time.