Fair Oaks Ortho Data Breach 2026: 1,544 Virginia Hand Surgery Patients Exposed via Email Compromise. What To Do

What happened

Fair Oaks Ortho P.C. is a solo-surgeon orthopedic practice at 3998 Fair Ridge Drive, Suite 100, Fairfax, Virginia. The practice specializes in hand, wrist, elbow, and shoulder surgery, led by Dr. Stephen W. Pournaras, Jr., MD (board-certified orthopedic surgeon) with David Park, PA-C. The practice is single-location and near Inova Fair Oaks Hospital. Patient phone: 703.591.0077.

This is a distinct entity from OrthoVirginia Fair Oaks and Fair Oaks Orthopaedic Associates.

Fair Oaks Ortho filed with HHS OCR on February 2, 2026 — a Hacking/IT Incident at Email affecting 1,544 individuals. Under HIPAA’s 60-day notification rule, discovery was likely on or after early December 2025.

The OCR classification (“Hacking/IT Incident at Email”) at this scale is consistent with the textbook business email compromise (BEC) / phishing-driven mailbox takeover pattern. Specific compromise dates, dwell times, and the threat actor have not been publicly disclosed.

Why this page is sparse

As of mid-May 2026, no entity notice has been posted on handsurgeonfairoaks.com. No notice letter has been located via the Maine, California, or Massachusetts AG portals. No HIPAA Journal, Washington Post, or local Northern Virginia coverage has surfaced. Virginia’s AG breach notices are not publicly indexed in a searchable database (filings go to the OAG but are not routinely posted).

This is normal for a sub-2,500 BEC incident at a solo practice — these are typically OCR-only filings until a plaintiff firm picks them up.

If you receive a Fair Oaks Ortho notification letter, the letter will list the specific data elements involved in your case, the discovery date, and any monitoring services offered.

What was likely exposed

The PHI categories are not publicly disclosed. For an email-BEC incident at a solo orthopedic practice, the email account most likely contained a subset of:

• Full name
• Date of birth
• Address, contact information
• Health insurance information
• Treatment / diagnosis information
• Possibly Social Security number or financial information (if those appeared in mailbox attachments — referrals, intake forms, billing correspondence)

Read your specific notification letter for the confirmed data elements.

What to do

1. Read your specific notification letter to confirm what data elements were involved in your case.
2. Call the practice at 703.591.0077 if you have not received a letter but suspect you should have.
3. Place free credit freezes at Equifax, Experian, TransUnion as a baseline precaution.
4. Watch your insurance Explanation of Benefits statements for unfamiliar orthopedic claims.
5. Stop the ongoing flow of your hand surgery data. HealthConsent files HIPAA restriction requests so the orthopedic treatment data exposed in this breach is not continuously re-shared.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches