HackingHealthcareHealthcareCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDPHIHealth (basic)HighContained

Shelby Dermatology, PC

bd_621f7d90327bc32c · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 7, 2025

Filed

Jun 11, 2025

To disclose

14 weeks

Affected · nationwide

86,4141 in this filing

Linked

4 filings

Confidence

66%

Full breach record for Shelby Dermatology, PC →

Shelby Dermatology, PC d/b/a Dermatologists of Birmingham discovered suspicious network activity on March 7, 2025. An investigation revealed that an unauthorized individual may have acquired patient information, including names and Social Security numbers. Approximately 86,414 individuals were affected, including 1 New Hampshire resident. The organization engaged forensic specialists, retained legal counsel, and offered 12 months of credit monitoring and identity theft restoration services through TransUnion.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 14 weeks / 96 days

Mar 7, 2025

Discovered

Jun 11, 2025

Filed

vs. sector median

+3 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_ab52b676b95f0acb2025-06-04 · +7dVerified
Nebraska State AGbd_d061d1e7c4d134bf2025-06-04 · +7dVerified
Illinois State AGbd_83def87cbff0752f2025-06-01 · +10dVerified

Name: Shelby Dermatology, PC
norm: shelby dermatology

Name: Shelby Dermatology, PC
norm: shelby dermatology
Also named: Shelby Dermatology, PCdba oflegal entity
Dermatologists of Birminghamdba oftrade name
Industry: Healthcarellm

Discovered: Mar 7, 2025
Materiality determined: —
Notification sent: Jun 4, 2025
Affected individuals: 86,414state + nationwide
Data types: Identity (basic)Government IDPHIHealth (basic)
Data elements: Social Security number
Attack vector: Unknown
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General

During the incident: Retained legal counsel and third-party forensic specialists to investigate the suspicious activity
Engaged a specialized cybersecurity firm to conduct a forensic investigation
Began a comprehensive review of the data set to determine what sensitive and/or personal information was impacted
Informed its law firm and began identifying the affected individuals in preparation for notice
Offered 12 months of complimentary credit monitoring and identity theft restoration services through Transunion
Changes made: Provided guidance on how to better protect against identity theft and fraud
Provided information on how to place a fraud alert and security freeze on one's credit file
Provided contact details for the national consumer reporting agencies
Provided information on how to obtain a free credit report
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(96 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Illinois State AGJun 1 · first

Massachusetts State AG+3d

Nebraska State AG+3d

New Hampshire State AG+10d · this page

Pattern: first filing Jun 1 (IL), last Jun 11 (NH) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/shelby-dermatology-dermatologists-birmingham-20250611.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 11, 2025
Raw hash: 507fd2daa29dc6882985f48db4f20c4d5d929f210131394456f5a690d93e60b2

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityShelby Dermatology, PC

Victim entityShelby Dermatology, PC

Incidentdiscovered Mar 7, 2025

Stated responseRetained legal counsel and third-party forensic specialists to investigate the suspicious activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov