Another plastic surgery practice fell prey to a cyberattack that acquired patient photos and info

On 23 October 2025, Michael R. Schwartz, MD, FACS, notified the California Attorney General’s Office that, on 25 August, they became aware of remote, unauthorized access to one of their computers. Investigators found that an unauthorized party had accessed patient files between 20 January and 26 August.

The notification letter did not disclose the number of patients affected but noted that information for each patient might include names, Social Security numbers (if provided), addresses, email addresses, phone numbers, photographs and medical record numbers, according to the letter. Dr.

Schwartz engaged leading cybersecurity experts to investigate and strengthen security controls, and he states that all office computers and servers have been replaced, network protections enhanced, and staff training on data security practices implemented.

The practice is offering affected individuals complimentary access to Experian IdentityWorksSM for 12 months, and, as of publication, no group had publicly claimed responsibility for the attack, with HHS not updating its public leak site in more than a month. according to California Attorney General’s Office