Alexes Hazen MD Data Breach 2026: 500+ NYC Plastic Surgery Patients Exposed. Breast Reconstruction Photos in Scope. What To Do

What happened

Alexes Hazen MD, PLLC is a private plastic surgery practice on Manhattan’s Upper East Side, led by Dr. Alexes Hazen, MD, FACS — board-certified plastic surgeon, Clinical Associate Professor at the Hansjorg Wyss Department of Plastic Surgery, NYU Grossman School of Medicine / NYU Langone Health, and former Director of the NYU Aesthetic Surgery Center (2002-2018). Clinical focus: breast surgery (cancer reconstruction and aesthetic), fat grafting reconstruction, nipple/areola tattooing, facial reconstruction, face transplant, and transgender surgery.

The patient population skews toward breast cancer survivors and post-mastectomy reconstruction patients — a high-sensitivity cohort by any measure.

Between June 23 and July 15, 2025, an unauthorized actor accessed the practice’s network. The intrusion was discovered on January 20, 2026 — a ~6-month gap between the access ending and discovery. The practice filed with HHS OCR on February 12, 2026 (placeholder 500; Hacking/IT Incident at Email + Network Server). Lynch Carpenter LLP announced a class action investigation on March 12, 2026.

No ransomware group has publicly claimed responsibility. The dual “Email + Network Server” OCR designation is consistent with BEC / phishing initial vector + lateral movement to a network share — a common pattern for boutique medical practices with small IT footprints.

Why this exposure profile is severe

The practice notice explicitly lists photographs in scope. Given the practice specialty, these almost certainly include pre- and post-operative clinical photography of breast reconstruction and cosmetic procedures. The combination of:

• Breast cancer survivor identity (cancer diagnosis disclosed)
• Intimate clinical imagery (pre/post-op breast and body photographs)
• Full identity data (name + SSN + government ID + insurance)

creates one of the most personally sensitive exposure profiles in the 2026 breach landscape. Threat actors holding clinical imagery of breast cancer survivors have used it for sextortion and harassment in prior incidents.

What was stolen

Per the entity’s notice:

• Full name, date of birth, demographic data
• Social Security number
• Government-issued ID
• Medical history
• Condition / procedure / diagnosis
• Medication information
• Health insurance information
• Payment information
• Photographs (pre/post-operative clinical photography — implied by practice specialty)

What Alexes Hazen MD is offering

• Toll-free hotline: 877-206-5545 (Monday to Friday, 9 a.m. to 5 p.m. Eastern)
• Third-party cybersecurity specialists engaged; law enforcement notified

Credit monitoring or IDX offering is not confirmed in publicly indexed sources. Read your specific notification letter for activation details.

What to do

1. Read your specific notification letter to confirm what data elements were involved in your case — particularly whether your pre/post-op photographs are in scope.
2. Place free credit freezes at Equifax, Experian, TransUnion. Full SSN and government ID are in scope.
3. File IRS Form 14039.
4. If your clinical photographs were in scope: document the breach in case the imagery surfaces in future contexts (sextortion attempts, harassment, employment background). Consider proactively informing close family or partners so a future disclosure doesn’t surprise you.
5. If you are a breast cancer survivor or transgender patient, recognize that the combination of treatment-context disclosure with intimate imagery has compounded harm — emotional support resources are appropriate alongside identity-theft protection.
6. Stop the ongoing flow of your plastic surgery and oncology records. HealthConsent files HIPAA restriction requests so the reconstruction, oncology-context, and image data exposed in this breach is not continuously re-shared.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches