Brainard Surgery Center LLC Data Breach 2025: 1,820 Affected · Hacking/IT Incident · OH. Filed With HHS OCR. What To Do.

Brainard Surgery Center LLC, an outpatient surgical facility in Lyndhurst, Ohio, filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on April 24, 2025, reporting a Hacking/IT Incident affecting a Network Server. The current OCR portal entry lists 1,820 affected individuals, revised upward from the initial placeholder of 501 once the file review concluded.

According to Brainard’s public notice and reporting from HIPAA Journal and plaintiff-firm investigations, the center detected suspicious activity on its network on February 23, 2025. Third-party cybersecurity and digital forensics specialists were engaged, and the investigation confirmed that an unauthorized third party had accessed the network and copied files containing patient data. No ransomware group has publicly claimed the incident.

Timeline

• February 23, 2025 — Suspicious activity detected on Brainard’s computer network.
• April 24, 2025 — Breach filed with the HHS Office for Civil Rights as a Hacking/IT Incident at a Network Server.
• April 29, 2025 — Brainard posts a substitute notice and begins mailing individual notification letters; plaintiff law firms publicly announce investigations the same week.

What was exposed

Per Brainard’s notice, the data elements varied by individual but included names plus some or all of the following:

• Mailing address
• Date of birth
• Social Security number
• Driver’s license number or other state identification number
• Medical claims information
• Health insurance information
• Clinical information such as diagnoses, conditions, and medications

This combination — full identifiers plus SSN, government ID, and clinical detail — is on the higher-risk end of healthcare breach exposure. Driver’s license numbers and Social Security numbers in particular are durable identifiers that do not expire.

What Brainard is offering

Brainard’s published notice directs affected individuals to a dedicated call line at 1-888-830-8199 (Monday through Friday, 9:00 am to 5:00 pm ET) and to its mailing address at 29017 Cedar Road, Lyndhurst, OH 44124. Public reporting to date does not specify the duration or provider of any complimentary credit-monitoring offered; the notification letter sent to each affected individual will state those terms.

Class-action posture

As of the last update on this page, no consolidated class-action complaint has been publicly docketed against Brainard Surgery Center LLC. Multiple plaintiff firms — including Strauss Borrelli PLLC and The Lyon Firm — have announced investigations and are soliciting affected individuals. Healthcare breaches of this size and data-element profile commonly draw at least one filing within ninety days of substitute notice; this page will be updated if a complaint is docketed.

What to do if you may be affected

• Freeze your credit with Equifax, Experian, and TransUnion. It is free, takes about ten minutes per bureau, and is the single highest-leverage step against new-account identity theft. A freeze is more protective than monitoring, which only alerts you after misuse occurs.
• Read the notification letter carefully. It will list the specific data elements exposed for you (these vary by individual) and the terms of any complimentary credit-monitoring or identity-protection service offered. Enroll if offered — it is free.
• Replace your driver’s license number through the Ohio BMV if your license number was among the exposed elements. Driver’s license numbers do not rotate on their own and are useful for synthetic-identity fraud.
• Be alert to targeted phishing. Threat actors who exfiltrate clinical detail sometimes use it in follow-on social-engineering campaigns referencing real medications, providers, or appointment history.
• Bookmark this page. We update it as additional disclosures, court filings, or settlement notices become publicly available.

Sources on this page

• HHS Office for Civil Rights Breach Portal — federal regulatory record of this breach.
• HIPAA Journal coverage — established trade press summary of Brainard’s disclosure.
• Strauss Borrelli PLLC investigation notice — plaintiff-firm announcement and exposed-data summary.
• ClassAction.org page — investigation status.
• The Lyon Firm investigation page — additional plaintiff-firm coverage.
• calHIPAA April 2025 breach report — context on the OCR placeholder filing.