Alerted to a breach in November, Advanced Family Surgery Center remains publicly silent

Advanced Family Surgery Center (AFSC) in Oak Ridge, Tennessee, part of Covenant Health, says little about a breach first disclosed by threat actors Genesis, who contacted AFSC on 26 November 2025 to claim they had been compromised.

On 11 January Genesis added AFSC to its dark web leak site, alleging exfiltration of 100 GB of data including healthcare, personal, financial, and operational data, with file listings showing protected health information such as patient names, dates of birth, full social security numbers, dates of service and treating physicians.

DataBreaches[.]net emailed AFSC for a response on 19 January, prompting Covenant Health to reply hours later and question whether DataBreaches had the right target, before promptly clarifying the intended recipient. The site notes no AFSC data has been leaked as of publication, while the countdown on Genesis’s leak site had run down yesterday; under HIPAA, regulated entities are supposed to notify patients and HHS no later than 60 days from discovery.

The article states Covenant Health has issued no substantive media notice or notification as yet, and the breach status does not appear in HHS’s public breach tool.