MedStar Health, a non-profit health system that operates 10 hospitals in the Baltimore-Washington metropolitan area, has recently disclosed a cyberattack and data breach that was first identified on October 4, 2025. The forensic investigation confirmed that an unauthorized third party gained access to certain internal systems that contained patient data between September 12, 2025, and September 16, 2025.
The files accessed in the attack were reviewed, and on November 12, 2025, MedStar Health confirmed that the compromised files contained patient data, including names, dates of birth, Social Security numbers, and potentially diagnoses, medications, test results, images, health insurance, and treatment information. MedStar Health said that prior to the attack, physical, technical, and administrative safeguards had been implemented to safeguard patient data. On this occasion, they failed to detect and block the attack. MedStar Health said it continuously evaluates its cybersecurity measures and will continue to do so in the future.
On December 3, 2025, notification letters started to be mailed to the affected individuals. As a precaution against identity theft and fraud, the affected individuals have been offered complimentary credit monitoring and identity theft protection services. The affected individuals are advised to take advantage of those services and monitor their accounts and explanation of benefits statements closely…