Space Coast Vascular Data Breach 2025: 18,819 Melbourne FL Vascular Patients Exposed in Hacking Incident. SSNs, Driver's Licenses, Medical Records Compromised. What To Do.

Space Coast Vascular, a vascular and venous health diagnostic laboratory and treatment center in Melbourne, Florida, was hit by a criminal cyberattack on or around January 13, 2025. After a months-long forensic review, the practice determined on August 7, 2025 that patient protected health information had been exposed and may have been viewed or acquired by the threat actor. The incident was reported to the HHS Office for Civil Rights on October 6, 2025, listing 18,819 affected individuals under “Hacking/IT Incident” at “Network Server.” Notification letters to affected patients followed, and at least four plaintiff firms have publicly opened class-action investigations.

Timeline

• January 13, 2025 — A criminal cyberattack impacts Space Coast Vascular’s computer systems. The practice engages third-party cybersecurity experts to investigate.
• August 7, 2025 — The investigation concludes that patient PHI was exposed and may have been viewed or acquired by the threat actor.
• October 6, 2025 — The breach is reported to HHS OCR as a hacking incident affecting 18,819 individuals with PHI located on a network server.
• October 7, 2025 — Strauss Borrelli PLLC announces a breach investigation on behalf of affected patients.
• October 9, 2025 — Individual notification mailings begin; the practice posts a substitute notice and a description of the specific data elements involved.
• October 14, 2025 — Lynch Carpenter, LLP publicly announces it is investigating claims against Space Coast Vascular on behalf of affected individuals.

What was exposed

According to the entity’s notice and reporting by HIPAA Journal and multiple plaintiff firms, the data elements exposed vary by individual but may include:

• Full name
• Date of birth
• Social Security number
• Driver’s license or state-issued ID number
• Medical treatment information
• Health insurance information
• Financial account information

No specific ransomware group has publicly claimed responsibility, and no leak-site posting of Space Coast Vascular data has been independently reported in the sources reviewed. The OCR portal entry classifies the incident as “Hacking/IT Incident” at “Network Server.”

What Space Coast Vascular is offering

• At least 12 months of complimentary credit monitoring and related identity-protection services to notified individuals. Enrollment instructions are included in the individual notification letter.
• A list of the specific data elements impacted is being provided to each affected individual.
• The practice states it has implemented a series of cybersecurity improvements to reduce the risk of similar incidents in the future.
• At the time of notification, Space Coast Vascular reported no known misuse of patient data arising from the incident.

Class-action and regulatory posture

The HHS OCR portal entry remains open and under investigation. No state attorney general public-notice link has been independently identified at this time, though Florida law requires breach notice to the Department of Legal Affairs when 500 or more Florida residents are affected.

At least four plaintiff-side firms have publicly opened investigations into the breach:

• Strauss Borrelli PLLC (announced October 7, 2025)
• Lynch Carpenter, LLP (announced October 14, 2025; contact attorney Jerry Wells)
• Edelson Lechtzin / EKSM
• ClassAction.org-affiliated counsel

No consolidated complaint or case number has yet been independently verified in the sources reviewed.

What to do if you may be affected

1. Enroll in the offered credit monitoring. Your notification letter contains a single-use enrollment code for at least 12 months of complimentary service. Use it.
2. Place free credit freezes at Equifax, Experian, and TransUnion. Because Social Security numbers and driver’s license numbers were exposed, a security freeze is materially more protective than monitoring alone. It is free and reversible, and takes roughly ten minutes per bureau.
3. File IRS Form 14039 if your letter confirms SSN exposure, to flag your tax account against fraudulent return filings.
4. Watch for medical identity theft. Because treatment and insurance information was exposed, review every Explanation of Benefits and request a copy of your medical record from your insurer if you see services you did not receive.
5. Be alert to targeted phishing and calls. Threat actors holding name, date of birth, address, and vascular-treatment context can craft highly convincing follow-on lures referencing Space Coast Vascular or your visits. Treat unexpected calls, texts, or emails with skepticism.
6. Stop the ongoing flow of your medical data. HealthConsent files HIPAA restriction requests so the information exposed in this breach is not continuously re-shared by downstream entities.

Sources

• HHS Office for Civil Rights Breach Portal — federal regulatory record (filing dated 2025-10-06, 18,819 affected, Hacking/IT Incident, Network Server).
• ClassAction.org — Space Coast Vascular Data Breach Impacts Personal, Health Info — entity description, exposed data elements, investigation status.
• Strauss Borrelli PLLC — Space Coast Vascular Data Breach Investigation — exposed data elements, breach notice language, October 7, 2025 investigation announcement.
• GlobeNewswire — Lynch Carpenter Investigates Claims in Space Coast Vascular Data Breach — class-action investigation announcement, exposed data elements, attorney contact.
• EKSM — Space Coast Vascular Announces Data Breach — August 7, 2025 discovery date, unauthorized access confirmation.
• The Florida Tribune — Lynch Carpenter Investigates Claims in Space Coast Vascular Data Breach — Florida press confirmation of the breach and class-action investigation.