How do I know if I am affected by the Waterford Surgical Center data breach?

Waterford Surgical Center is mailing notification letters directly to affected individuals. If you have received care or services from Waterford Surgical Center in the period leading up to January 2026 and you have not received a letter, contact the entity directly. 9,000 individuals were confirmed affected in the HHS OCR filing.

What data was exposed in the Waterford Surgical Center breach?

According to the notification letter and supporting filings, the compromised data included: Full name, Social Security number, Date of birth, Medical / health information, Treatment / diagnostic information, Health insurance information, Billing / payment information, Credentialing information.

Was Waterford Surgical Center attacked by a ransomware group?

Yes — the SafePay Ransomware group (double-extortion: exfiltration + encryption) claimed responsibility for the attack on Waterford Surgical Center. The stolen data was posted publicly on a dark-web leak site.

Should I file a lawsuit over the Waterford Surgical Center data breach?

1 plaintiffs' firms have publicly announced investigations or filed complaints related to the Waterford Surgical Center breach: Shamis & Gentile (publicly investigating). We are not a law firm and cannot give legal advice; consult your own attorney to evaluate your options.

What is HealthConsent and how does it help with the Waterford Surgical Center breach?

HealthConsent is an independent health-data privacy service. We help affected individuals stop the ongoing flow of their health information by filing HIPAA restriction requests, FTC Health Breach Notification Rule deletion requests, and state-law deletion requests across providers, insurers, Health Information Exchanges, prescription networks, and data brokers. Credit monitoring offered by Waterford Surgical Center addresses identity-theft risk; HealthConsent addresses the longer-tail problem of your exposed health data continuing to be sold and shared by other entities downstream.

Active breach tracker Waterford, MI Disclosed January 22, 2026

Waterford Surgical Center Data Breach 2026 (SafePay Ransomware): 9,000 Michigan Ambulatory Surgery Patients Exposed. No Credit Monitoring Offered. What To Do

Waterford Surgical Center, a Michigan ambulatory surgical center, was attacked by the SafePay ransomware group in September 2025. Names, Social Security numbers, dates of birth, medical/treatment information, health insurance, billing, and credentialing data for 9,000 patients exposed. No credit monitoring offered. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated May 15, 2026 Sources & methodology

Timeline

Sep 1, 2025

SafePay ransomware gang lists Waterford Surgical Center on dark-web leak site

Sep 3, 2025

Unauthorized network access discovered (entity-stated date)

Sep 3, 2025

Attacker gained access

Jan 22, 2026

Notification letters issued

Jan 22, 2026

Disclosed publicly

Sep 1, 2025

SafePay ransomware gang lists Waterford Surgical Center on dark-web leak site

Sep 3, 2025

Unauthorized network access discovered (entity-stated date)

Sep 3, 2025

Attacker gained access

Jan 22, 2026

Notification letters issued

Jan 22, 2026

Disclosed publicly

Data exposed

High-risk identity

Enables financial + identity theft

Social Security number Date of birth

Health records

Don't expire and can't be reissued

Treatment / diagnostic information

Contact & insurance

Phishing + targeted scams

Full name Medical / health information Health insurance information Billing / payment information Credentialing information

Class actions filed by

These firms have publicly announced investigations. You may be eligible to join. We are not a law firm and cannot give legal advice.

Shamis & Gentile (publicly investigating)

If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

Accept credit monitoring

It’s the floor of the response. Take it.

Freeze your credit

Free at Equifax, Experian, TransUnion.

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

Review your EOBs

Insurance statements catch medical identity theft early.

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

Waterford Surgical Center is a physician-owned ambulatory surgical center (ASC) in Waterford, Michigan, performing orthopedic, plastic, general, GI, and other surgical specialties. Single-site, not a hospital system.

On September 1, 2025, the SafePay ransomware group listed Waterford Surgical Center on its dark-web leak site. The entity’s own incident notice cites September 3, 2025 as the date of unauthorized network access discovery. The forensic and notification process took several months. Notification letters were issued on January 22, 2026 confirming 9,000 affected individuals in the HHS OCR filing.

The entity’s notice describes only “unauthorized network access by an unknown actor” and does not name SafePay. The SafePay attribution comes from the group’s own dark-web leak-site posting.

What was stolen

Per the entity’s notice:

Full name
Social Security number
Date of birth
Medical / health information
Treatment / diagnostic information
Health insurance information
Billing / payment information
Credentialing information

SafePay’s leak-site claim additionally lists addresses, phone, email, and driver’s license / state ID copies — but those broader fields are attacker-claimed, not entity-confirmed.

What Waterford Surgical Center is offering

The published notice does not offer complimentary credit monitoring or identity-theft protection. Recommendations are limited to free fraud alerts and security freezes at Equifax, Experian, and TransUnion. The notice includes a toll-free call center number (Monday to Friday).

The absence of credit monitoring for a 9,000-affected breach with full SSN exposure is uncommon for the industry and is likely a focal point of any class action.

What to do

Place free credit freezes at Equifax, Experian, TransUnion. Waterford is not providing monitoring.
File IRS Form 14039.
Consider purchasing your own credit monitoring — given the SSN + DOB + medical + financial exposure profile.
Cancel and reissue any payment cards that may be tied to billing/payment information.
Stop the ongoing flow of your surgical-center data. HealthConsent files HIPAA restriction requests so the demographic, surgical, and billing data exposed in this breach is not continuously re-shared.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.