Dermatology Associates of Concord Data Breach 2025: ANUBIS Ransomware Group Exfiltrates Patient Files in Massachusetts. What To Do.

Dermatology Associates of Concord (DAC), a greater-Boston dermatology practice operating as Total Skin Health, confirmed that an unauthorized party accessed one of its computer systems between September 18 and September 19, 2025, and copied files containing protected health information. The ANUBIS ransomware group subsequently claimed the attack and posted DAC to its dark-web leak site on November 6, 2025. (ClaimDepot; PR Newswire via Morningstar)

Timeline

• September 18-19, 2025 — An unauthorized third party accessed a specific computer system on the DAC network and copied files from that system. (Health Technology Net)
• September 19, 2025 — DAC identified suspicious activity, engaged third-party cybersecurity experts, notified law enforcement, and began enhancing its security protocols. (HIPAA Journal)
• November 6, 2025 — The ANUBIS ransomware group posted DAC to its dark-web leak site, publicly claiming exfiltration of patient files. (ClaimDepot)
• November 18, 2025 — DAC filed initial breach notification with the Massachusetts Attorney General and the HHS Office for Civil Rights. (Mass.gov; HHS OCR Breach Portal)
• February 18, 2026 — DAC issued a public substitute notice and began mailing individual notification letters to affected individuals for whom it had postal addresses. (PR Newswire via Morningstar)

What was exposed

Per DAC’s substitute notice, the types of information potentially impacted vary by individual but may include:

• Name
• Address
• Date of birth
• Social Security number
• Driver’s license number
• Passport number
• Military identification number
• Taxpayer identification number
• Financial account information
• Payment card information
• Medical information
• Health insurance information

DAC states that its electronic medical record (EMR), payment-processing, payroll, and email systems were not impacted; the unauthorized access was confined to a specific computer system from which files were copied. (Health Technology Net)

What DAC is offering

DAC is providing affected individuals with 24 months of complimentary single-bureau credit monitoring, single-bureau credit reports, and single-bureau credit scores through Cyberscout, along with identity-theft and fraud assistance services. A dedicated response line is available at 1-800-405-6108, Monday through Friday, 8:00 a.m. to 8:00 p.m. ET. (ClaimDepot; PR Newswire via Morningstar)

Class-action posture

Maxey Law Firm, P.A. (attorney Ryan Maxey) is publicly investigating class-action claims on behalf of affected DAC patients, with a stated focus on whether Social Security numbers were properly encrypted at rest. The firm reports being in the preliminary investigation phase rather than holding a filed complaint as of this update. (Maxey Law Firm investigation page)

The HHS Office for Civil Rights investigation remains open per the breach portal entry.

What to do if you may be affected

1. Read your notification letter carefully when it arrives. DAC’s letter lists the specific data elements implicated for your record. The dedicated response line is 1-800-405-6108 (Monday to Friday, 8:00 a.m. to 8:00 p.m. ET). (PR Newswire via Morningstar)
2. Enroll in the 24-month Cyberscout credit monitoring offered at no cost. Activation deadlines are typically printed on the notification letter; missing them forfeits the benefit.
3. Place free credit freezes at Equifax, Experian, and TransUnion. Because Social Security numbers, driver’s license numbers, and passport numbers may be in the leaked dataset, a freeze is materially more protective than monitoring alone.
4. Watch for payment-card fraud and EOB anomalies. Because payment-card information and health-insurance details are in scope, monitor card statements and any explanation-of-benefits statements from your insurer for unfamiliar charges or claims.
5. Stop the ongoing flow of your dermatology and medical-record data. HealthConsent files HIPAA restriction requests across dermatology practice networks and downstream data brokers.

Sources

• Dermatology Associates of Concord: Notice of Data Security Incident (PR Newswire via Morningstar) — DAC’s official substitute notice with exposed-data list, response phone number, and Cyberscout offering.
• Health Technology Net: Dermatology Associates of Concord Provides Notice of Data Security Incident — secondary publication of the substitute notice clarifying which systems were not affected.
• HIPAA Journal: Data Breaches Announced by Ennoble Care & Circa Health; Dermatology Associates of Concord — trade-press summary of detection date, investigation, and notification status.
• ClaimDepot: Dermatology Associates Data Breach — ANUBIS ransomware-group leak-site listing on November 6, 2025; Cyberscout enrollment and response-line details.
• Maxey Law Firm: Dermatology Associates of Concord Data Breach Lawsuit Investigation — plaintiff-side investigation by attorney Ryan Maxey.
• Mass.gov: Data Breach Notification Letters November 2025 — Massachusetts AG public log of DAC’s November 18, 2025 filing.
• HHS Office for Civil Rights Breach Portal — federal regulatory filing.