Austin Plastic & Reconstructive Surgery Data Breach 2026 (3AM Ransomware): 4,266 Texas Patients Exposed. Breast Reconstruction Practice. What To Do

What happened

Austin Plastic & Reconstructive Surgery is a boutique plastic surgery practice at 2905 San Gabriel Street, Suite 100, Austin, Texas. Led by board-certified plastic surgeon Dr. Christine Fisher with Dr. Tosan Ehanire and Dr. Danielle Dumestre, the practice has a strong focus on microvascular breast reconstruction for breast cancer patients (cited 4,500+ reconstructions), plus cosmetic surgery and an in-house MedSpa.

Between June 30 and July 1, 2025, an unauthorized actor accessed the practice’s network. The intrusion was detected and forensically confirmed on or around July 1, 2025. On August 10, 2025, the 3AM (ThreeAM) ransomware group listed Austin Plastic & Reconstructive Surgery on its Tor leak site.

The review of impacted individuals completed on February 28, 2026. Consumer notification letters were mailed on March 11, 2026, and the HHS OCR submission was filed on March 30, 2026 — confirming 4,266 affected individuals (4,041 Texas residents).

Notification gap: ~9 months between intrusion and patient notice; ~7 months between threat-actor leak and notice — both exceed typical HIPAA Breach Notification Rule expectations.

3AM is a Rust-based ransomware family active since late 2023. It is sometimes used as a fallback when LockBit fails to deploy.

A sensitive patient population

Austin Plastic & Reconstructive Surgery’s practice profile is heavily weighted toward breast reconstruction for breast cancer survivors. The intersection of cancer diagnosis records, reconstruction surgical history, and (likely) clinical photographs creates an unusually sensitive exposure profile.

The practice’s official notice does not enumerate clinical or pre/post-operative photographs as being in the exfiltrated set. Plastic surgery practices typically maintain such photographs, and threat actors are known to use them as leverage, but no public source confirms photos were stolen.

What was stolen

Per the entity’s notice:

• Full name, home address, date of birth
• Social Security number
• Driver’s license / state ID number
• Passport number
• Financial account information
• Medical / health information
• Health insurance information

What Austin Plastic & Reconstructive Surgery is offering

• Complimentary credit monitoring and identity-theft protection for individuals whose SSNs were impacted (vendor and duration not publicly disclosed)
• Dedicated call center: 833-877-7496 (Monday to Friday, 8 a.m. to 8 p.m. Central; excluding holidays)
• Systems secured, cybersecurity professionals engaged

What to do

1. Read your specific notification letter to confirm what data elements were involved and what monitoring you have been offered.
2. Enroll in the offered credit monitoring if your SSN was in scope.
3. Place free credit freezes at Equifax, Experian, TransUnion. SSN, driver’s license, and passport are all in scope.
4. File IRS Form 14039.
5. Cancel and reissue any payment cards that may be tied to financial account information.
6. Stop the ongoing flow of your surgical and oncology records. HealthConsent files HIPAA restriction requests so the reconstruction, oncology-context, and image data exposed in this breach is not continuously re-shared.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches