Baltimore Medical System Data Breach 2025: Brain Cipher Ransomware Attack on Maryland FQHC. What To Do.

Baltimore Medical System, Inc. (BMS) — the largest Federally Qualified Health Center in Maryland, serving roughly 90,000 patients across nine clinical sites in the Baltimore area — was the target of a ransomware attack by the Brain Cipher group. According to BMS’s own forensic investigation, attackers had access to its network between July 2 and July 20, 2025, during which certain files were accessed or duplicated. The intrusion became public on September 16, 2025, when Brain Cipher listed BMS on its dark web leak site and began publishing data samples that, by some reports, exceeded 800 GB and appeared to include server-level file system and database backups. BMS filed a HIPAA breach notification with the HHS Office for Civil Rights on December 12, 2025, reporting 501 affected individuals — a number widely viewed as an interim placeholder given the volume of exfiltrated data and the size of BMS’s patient population.

Timeline

• July 2 – July 20, 2025 — Per BMS’s third-party forensic investigators, an unauthorized actor accessed the BMS network and accessed or duplicated certain files.
• September 16, 2025 — Brain Cipher publicly lists Baltimore Medical System on its dark web leak site, posting sample data and claiming several terabytes of exfiltrated information.
• December 12, 2025 — BMS files its HIPAA breach notification with HHS OCR, reporting 501 affected individuals (Hacking/IT Incident, Network Server).
• March 27, 2026 — BMS updates its public breach notice describing the categories of information involved.
• April 6, 2026 — Notification letters are mailed to affected individuals; plaintiffs’ firms — including Federman & Sherwood, Levi & Korsinsky, and The Lyon Firm — open class-action investigations.

What information was exposed

Based on BMS’s own breach notice and reporting on the data published to Brain Cipher’s leak site, the affected information includes:

• Full name, address, and contact information
• Date of birth
• Social Security number
• Government-issued identification (driver’s license or state ID)
• Medical record or patient identification number
• Diagnoses, treatment information, and lab results
• Medications
• Medicare and Medicaid identification numbers
• Health insurance and claims information
• Financial account information

Not every affected patient had every element exposed. The notification letter mailed to you will list the specific data elements that were compromised for your individual record.

Why a Federally Qualified Health Center breach matters

BMS is the largest FQHC in Maryland. FQHCs serve patients who are disproportionately low-income, uninsured or underinsured, on Medicaid or Medicare, and from medically underserved communities. The data compromised in this incident — SSNs, government IDs, Medicaid and Medicare numbers, financial account details, and detailed clinical records — is exactly the data set used to commit medical identity theft, file fraudulent claims against public insurance programs, and apply for credit or government benefits in someone else’s name. The downstream harm tends to fall hardest on patients who have the least margin to absorb it. The fact that Brain Cipher posted sample data publicly rather than holding it privately for ransom further increases the risk that this data is already in circulation among other threat actors.

Credit monitoring and what BMS is offering

As of the most recent public update, BMS’s notice directs affected individuals to monitor their own financial accounts and credit reports, consider fraud alerts or credit freezes with the three nationwide credit bureaus, and remain cautious of unsolicited communications. Specific details of any complimentary credit-monitoring or identity-protection product, including the provider and the enrollment deadline, will be listed in the individual notification letter you receive in the mail. If your letter offers a complimentary service, enroll — there is no cost to you and it adds a layer of monitoring on top of any freeze you put in place yourself.

Class-action investigations

Multiple plaintiffs’ firms have opened investigations into a possible class action against Baltimore Medical System, including Federman & Sherwood, Levi & Korsinsky, LLP, and The Lyon Firm. As of mid-May 2026, we are not aware of a filed complaint on the public docket; the matter remains in the pre-suit investigation phase. If a class action is filed and later certified or settled, you do not have to engage a firm individually — you will typically be notified as a class member and given an opportunity to file a claim. Engaging a firm now is optional and a personal choice.

What to do if you may be affected

• Freeze your credit with Equifax, Experian, and TransUnion. It is free, takes about ten minutes per bureau, and is the single highest-leverage step against new-account identity theft. A freeze does not affect your credit score and can be lifted temporarily when you need to apply for credit.
• Watch the mail for your notification letter. The letter will list the specific data elements involved for you and will describe any complimentary credit-monitoring or identity-protection service. Enroll in any service that is offered.
• If your Medicaid or Medicare number was exposed, review your Medicare Summary Notices and Medicaid Explanation of Benefits statements for services or claims you do not recognize. Report anything suspicious to your state Medicaid program or to 1-800-MEDICARE.
• Be alert for targeted phishing — phone calls, text messages, and emails that reference your care at BMS, your medications, or your diagnosis. The exposed clinical detail makes it easier for scammers to sound legitimate. When in doubt, hang up and call BMS directly using the number on your existing patient portal or appointment paperwork.
• Bookmark this page. We update it as the entity issues further notices, as state attorneys general post their copies of the substitute notice, and as any class-action complaint is filed.

Sources on this page

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach.
• Paubox — Baltimore Medical System hit by ransomware group Brain Cipher — attribution and FQHC context.
• Cybernews — Baltimore Medical System data leaked on dark web — dark-web leak details, sample sizes, FQHC patient count.
• teiss — Hacker gang claims breach of Baltimore Medical System, leaks patient data — trade press coverage of the Brain Cipher leak.
• ClassAction.org — Baltimore Medical System data breach exposes SSNs, lawsuit possible — data elements involved and class-action investigation status.
• Federman & Sherwood data breach investigation — plaintiffs’ firm investigation notice.
• The Lyon Firm — Baltimore Medical System data breach investigation — plaintiffs’ firm investigation notice.