Mid Florida Primary Care Data Breach 2025: 16,435 Patients Exposed in BianLian Ransomware Intrusion

Mid Florida Primary Care, PA, an internal medicine practice with offices in Leesburg and Summerfield, Florida, confirmed that an unauthorized actor accessed its network between November 29 and December 11, 2024, exfiltrating data tied to 16,435 patients. The intrusion was attributed to the BianLian ransomware group, which posted evidence of the attack on its dark-web leak site on December 14, 2024. The practice identified suspicious activity on January 23, 2025, filed its HIPAA breach notification with the HHS Office for Civil Rights on March 21, 2025, completed its document review on June 19, 2025, and began mailing individual notification letters on July 29, 2025.

Timeline

• November 29, 2024 — Unauthorized access to the Mid Florida Primary Care network begins.
• December 11, 2024 — Access window ends; the actor has copied data covering financial records, HR data, mailboxes, and patient records.
• December 14, 2024 — The BianLian ransomware group posts proof-of-attack samples on its dark-web leak site.
• January 23, 2025 — The practice identifies suspicious activity, engages outside counsel, and retains a third-party forensics firm.
• March 21, 2025 — HIPAA breach notification filed with the HHS Office for Civil Rights using the final affected count of 16,435.
• June 19, 2025 — File review concludes; the practice finalizes the data elements involved per individual.
• July 29, 2025 — Public disclosure issued; individual notification letters begin going out.
• July 30, 2025 — A copy of the consumer notice is filed with the Vermont Attorney General.

What was exposed

The data elements confirmed exposed vary by individual but include:

• Name and address
• Date of birth and email address
• Social Security number
• Driver’s license number
• Health insurance information, including Medicare and Medicaid numbers and plan or policy numbers
• Diagnosis and treatment information
• Medical history and allergies
• Prescription information
• Test results
• Treatment location

BianLian’s leak-site listing also claimed to contain financial records, HR data, internal and external email correspondence, and multiple patient records. BianLian operates an exfiltration-and-extortion model rather than encrypting systems, so the central risk for affected patients is downstream use of the stolen records, not service disruption at the practice.

What the entity is offering

Mid Florida Primary Care is offering complimentary identity monitoring through Privacy Solutions, with either 12 or 24 months of coverage depending on the risk profile of the records involved. The package includes:

• Credit monitoring via Equifax
• Access to credit reports and scores
• Identity theft insurance
• Identity restoration services
• Dark-web monitoring

Enrollment instructions and a single-use activation code are included in each individual notification letter. The practice has set up a dedicated assistance line at 877-580-5596 (Monday through Friday, 9 a.m. to 6 p.m. Eastern, excluding major holidays).

Class-action and regulatory posture

The HHS OCR breach portal entry remains open at 16,435 individuals, a Hacking/IT Incident at a Network Server. The Vermont Attorney General has the consumer notice on file. No consolidated class action has been filed in the sources reviewed as of this writing. ClassAction.org’s investigation page indicates plaintiff-side attorneys have completed their pre-suit review, and Strauss Borrelli PLLC has an open investigation soliciting potential plaintiffs. We will update this section if and when a complaint is docketed.

What to do if you may be affected

• Freeze your credit with Equifax, Experian, and TransUnion. Because Social Security numbers and driver’s license data were exposed, a security freeze is materially more protective than monitoring alone. It is free and reversible.
• Enroll in the offered identity monitoring. The 12 or 24 months of Privacy Solutions coverage is worth using even if you also freeze your credit; the enrollment code in your letter is single-use.
• Watch for medical identity theft. Diagnosis, prescription, and insurance information was exposed. Review every Explanation of Benefits and request a copy of your medical record from your insurer if you see services you did not receive.
• Be alert to targeted phishing. With name, address, date of birth, and treatment context in hand, threat actors can craft very convincing follow-on lures. Treat unexpected calls or emails referencing your Mid Florida Primary Care visits with skepticism.
• Keep your notification letter. It documents your status as an affected individual, which matters for any future class-action claim or insurance dispute.

Sources

• HHS Office for Civil Rights Breach Portal — federal regulatory record (filing dated 2025-03-21; 16,435 affected; Hacking/IT Incident at Network Server).
• HIPAA Journal — Florida Internal Medicine Practice Discloses November 2024 Data Breach — incident timeline, exposed data elements, monitoring offer.
• Vermont Attorney General — 2025-07-29 Mid Florida Primary Care Data Breach Notice to Consumers — state-filed consumer notice.
• Comparitech — Florida clinic notifies 16K people of data breach that exposed SSNs and medical histories — affected count and BianLian attribution.
• ClaimDepot — Mid Florida Primary Care Discloses Data Breach Following Ransomware Attack — BianLian dark-web posting date, monitoring vendor and coverage tiers, assistance line.
• ClassAction.org — Mid-Florida Primary Care Data Breach Exposes Medical Information — plaintiff-side investigation status.
• Strauss Borrelli PLLC — Mid Florida Primary Care Data Breach Investigation — law-firm investigation summary.