Cardiovascular Medicine Associates (doing business as MyCardiologist) Data Breach 2025: 2,248 Affected · Hacking/IT Incident · FL. Filed With HHS OCR. What To Do.

Cardiovascular Medicine Associates, PA, the cardiology group operating as MyCardiologist across South Florida, reported a HIPAA breach to the U.S. Department of Health and Human Services Office for Civil Rights on October 6, 2025, listing 2,248 affected individuals in a Hacking/IT Incident involving its email environment. According to the entity’s own disclosures and reporting compiled by HIPAA Journal and plaintiffs’ firms, an unauthorized third party accessed MyCardiologist’s email systems between May 30 and June 12, 2025, before the activity was detected and contained.

Timeline

• May 30, 2025 — Unauthorized access to the MyCardiologist email environment begins.
• June 12, 2025 — Suspicious activity is detected, ending the access window; MyCardiologist engages forensic investigators.
• September 9, 2025 — Internal review identifying affected individuals and data elements is reported as complete.
• October 6, 2025 — Breach is filed with HHS OCR as a Hacking/IT Incident at Email, affecting 2,248 individuals.
• October 7, 2025 — Individual notification letters begin mailing to affected patients.
• October 14, 2025 — Plaintiffs’ firms publicly announce investigations into potential class-action claims.

Data exposed

The HHS OCR portal classifies the underlying breach surface as Email. Notification reporting describes the at-risk data elements as including:

• Names
• Mailing addresses
• Dates of birth
• Social Security numbers
• Driver’s license numbers
• Payment card information
• Medicare numbers
• Clinical information, diagnoses, and provider name/location

Not every affected individual had every data element exposed; the specific combination is identified per-recipient in the individual notification letter.

What MyCardiologist is offering

MyCardiologist’s notification reporting indicates the practice is offering 24 months of complimentary credit monitoring and identity restoration services through Epiq Privacy Solutions, and has established a dedicated assistance line at 855-291-2561 (Monday-Friday, 9:00 a.m. to 9:00 p.m. ET) for patient questions.

Class-action posture

As of this update, no consolidated class-action settlement has been announced. Multiple plaintiffs’ firms — including Strauss Borrelli PLLC — have publicly opened investigations into potential class claims against Cardiovascular Medicine Associates, PA. Individual proposed class actions have been docketed in Florida state court; published case-tracking summaries reference filings in Miami-Dade County. Affected patients evaluating litigation should consult counsel directly; this page does not constitute legal advice.

What to do if you may be affected

• Read your individual notification letter carefully. It identifies the specific data elements exposed for your record and explains how to enroll in the complimentary 24-month credit monitoring offered through Epiq Privacy Solutions.
• Enroll in the credit monitoring before the deadline printed in your letter. If SSN or driver’s license number was exposed for your record, this is the highest-leverage step.
• Freeze your credit with the three nationwide consumer reporting agencies. Credit freezes are free, take roughly ten minutes per bureau, and prevent new accounts from being opened in your name.
• Watch your Medicare Summary Notices for services you did not receive. Medical identity theft can take months to surface.
• Be cautious of follow-up phishing. Threat actors sometimes target breach recipients with fake “claim your settlement” or “confirm your account” emails referencing the incident.

Sources on this page

• HHS Office for Civil Rights Breach Portal — federal regulatory record listing 2,248 affected, Hacking/IT Incident, Email.
• HIPAA Journal — established trade press summary of the MyCardiologist incident.
• Strauss Borrelli PLLC — plaintiffs’ firm investigation announcement (October 14, 2025).
• ClaimDepot incident page — third-party breach tracker summary of exposed data elements and remediation.
• ClaimDepot litigation tracker — class-action investigation tracker.