Brown Health Data Breach Exposes 311,760 Patient Records

Lifespan Physician Group of Massachusetts, doing business as Brown Health Medical Group‑MA, reported a cyber incident that occurred in December 2025 at its Hawthorn location. A review completed on June 22, 2026 found attackers had accessed files on a legacy file server and viewed stored records.

The practice says its electronic health record system was not affected. A sample notification was filed with the Massachusetts Office of Consumer Affairs and Business Regulation, and the organization informed the U.S. Department of Health and Human Services that 311,760 people were impacted, including 290,357 Massachusetts residents.

Files accessed included names, contact information and dates of birth. Social Security numbers, driver’s license and other government identification numbers were among the records viewed. Medical and disability-related records were accessed along with financial account details and credit and debit card numbers. Personnel and human resources records, including payroll and compensation information, plus licensure and credentialing documents were also in the set of files reviewed. The practice noted that not all categories of information were impacted for every person.

Officials isolated the affected server immediately after identifying the incident and implemented additional technical and administrative safeguards. Staff retraining was begun and the practice plans to notify affected individuals directly with details and instructions for enrolling in the protections offered.

Brown Health is providing two years of complimentary fraud detection, identity protection and restoration services to impacted people. The organization has not identified the threat actor and reports it is not aware of any claims of responsibility from known ransomware or extortion groups. The practice continues to review the incident and to coordinate with state and federal regulators.