HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedDelayed DiscoveryPHIHealth (basic)Identity (basic)LowContained

Facial Surgery Group, PC

bd_8ed6001fe2e696d9 · schema v1 · pii pii-v2

Severity

Low

Discovered

Nov 24, 2025

Filed

Oct 1, 2026

To disclose

—

Affected

1state residents only

Confidence

67%

Full breach record for Facial Surgery Group, PC →2 incidents on file

Facial Surgery Group, PC detected suspicious activity in an employee's email account on November 24, 2025. A forensic investigation concluded on February 2, 2026, determining potential unauthorized access to patient information including Date of Birth, Medical Record Numbers, Medicaid Numbers, Health Insurance Group Numbers, Medical Diagnosis/Treatment Information, and Provider Names. The organization disabled the account, changed passwords, and engaged third-party cybersecurity and data mining firms. No evidence of misuse was found. Credit monitoring services are being offered to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Nov 24, 2025

Discovered

Oct 1, 2026

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Facial Surgery Group, PC
norm: facial surgery

Name: Facial Surgery Group, PC
norm: facial surgery
Industry: Healthcarellm

Discovered: Nov 24, 2025
Materiality determined: —
Notification sent: Oct 16, 2026
Affected individuals: 1state-resident count only
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External

During the incident: Disabled the affected email account
Changed the account password
Terminated active sessions
Engaged a specialized third-party cybersecurity firm and IT personnel to conduct a comprehensive forensic investigation
Engaged a third-party data mining vendor to determine whose information and the type of information that was contained in the account
Engaged external cybersecurity experts to further assess and strengthen our accounts
Enhanced monitoring and access controls
Implemented additional safeguards to protect personal information
Providing access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing proactive fraud assistance
Changes made: Engaged external cybersecurity experts to further assess and strengthen our accounts
Enhanced monitoring and access controls
Implemented additional safeguards to protect personal information
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1814-facial-surgery-group/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 1, 2026
Raw hash: 05f391aa2b55f4e61f57ef44d43885b19bd11270ea3a1dd81b4b7baabb38976b

Reporting entityFacial Surgery Group, PC

Victim entityFacial Surgery Group, PC

Incidentdiscovered Nov 24, 2025

Stated responseDisabled the affected email account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov