Western Wayne Family Physicians Data Breach 2025: 62,000 Affected by Network-Server Hacking Incident at Michigan Primary Care Practice

Allen Park, Michigan primary care group Western Wayne Family Physicians, P.L.C. filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on March 26, 2025, reporting a hacking/IT incident on its network server that affected 62,000 individuals. The practice, established in 1996, operates clinics in Allen Park, Dearborn, and Livonia and provides primary care, chronic-disease management, cancer screenings, vaccinations, and other family-medicine services to patients of all ages. According to plaintiffs’ firm advisories citing the practice’s own investigation, an unauthorized third party gained access to Western Wayne’s computer network; the practice retained third-party cybersecurity experts to determine the nature and scope of the incident before beginning patient notification. Notification letters went out concurrent with the OCR filing, with an offer of complimentary credit monitoring. Within days, seven plaintiffs’ firms announced investigations, and the practice filed statutory notice with at least fourteen state attorneys general.

What happened

Western Wayne Family Physicians is a board-certified family-medicine group founded in 1996 and headquartered at 8338 Allen Road, Allen Park. Its three locations — Allen Park, Dearborn, and Livonia — serve patients of all ages across Wayne County, billing major insurers including Blue Cross Blue Shield, Blue Care Network, Aetna, HAP, Priority Health, Cigna, Medicare, and United Healthcare (Allen Park location only). The practice uses an electronic health record adopted in 2007 and carries a Patient-Centered Medical Home (PCMH) designation.

Western Wayne became aware of a security incident on its medical data systems and launched an investigation with the assistance of third-party cybersecurity experts. The investigation confirmed that an unauthorized third party gained access to the practice’s network server and that sensitive personal and protected health information was compromised. On March 26, 2025, the practice filed its HIPAA breach report with HHS OCR, reported 62,000 affected individuals, and simultaneously began mailing individual notification letters. The exact intrusion window, initial access vector, and identity of the threat actor have not been publicly disclosed as of this update.

The HIPAA Journal March 2025 breach report and calHIPAA both flag Western Wayne as the ninth-largest healthcare breach of the month. Both note that the practice did not publish a substitute notice or press release on its own website or through media channels. The practice filed statutory notice with at least fourteen state attorneys general, including California, Iowa, Maine, Massachusetts, Montana, Nebraska, New Hampshire, Oregon, Rhode Island, South Carolina, Texas, Vermont, and Washington. The HHS OCR investigation remains open.

What was stolen

Western Wayne Family Physicians has not published a full public itemization of the data elements on its website. The Arnold Law Firm’s investigation notice, which cites the individual notification letters, confirms that sensitive personal and protected health information was compromised. Based on multiple plaintiffs’ firm advisories and ClaimDepot’s incident tracking page, the information that may have been compromised includes any combination of the following, depending on the individual:

• Full name
• Date of birth and home address
• Social Security number
• Government-issued identification number
• Medical records and treatment information
• Health insurance information
• Financial account information

Not every data element was present for every affected patient. The specific elements listed in each individual notification letter govern. SSN exposure is confirmed through multiple law-firm advisories; affected individuals whose SSNs were included should treat SSN-specific identity-theft risks as confirmed.

What Western Wayne Family Physicians is offering

Recipients of the notification letter are being offered complimentary credit monitoring services. The practice has not published a dedicated incident webpage or publicly named the monitoring vendor. The enrollment instructions and deadline printed on the individual notification letter are the authoritative source. If you believe you may have received care from a Western Wayne Family Physicians clinic in Allen Park, Dearborn, or Livonia and have not received a letter, contact the practice directly: Allen Park (313) 386-5500, Dearborn (313) 565-6800, Livonia (734) 462-0090.

Class actions

The HHS OCR investigation remains open. At least seven plaintiffs’ firms have publicly announced investigations:

• Strauss Borrelli PLLC (April 2, 2025)
• The Lyon Firm (April 2, 2025)
• Levi & Korsinsky, LLP (April 8, 2025)
• Markovits, Stock & DeMarco, LLC
• Arnold Law Firm
• Srourian Law Firm
• Shamis & Gentile P.A.

No consolidated complaint has been publicly identified in federal docket searches through the date of this update. Individual putative class actions in Michigan state or federal court are possible given the volume of firm investigations and the confirmed SSN plus medical-record exposure. Michigan does not operate a public breach-notification portal, so the absence of a Michigan AG public filing is not unusual; the practice filed notice with at least fourteen other state attorneys general.

What to do

Social Security numbers and medical information are both in play, which means identity theft, tax-refund fraud, and medical identity theft are all live risks. Stack defenses:

1. Freeze your credit at all three bureaus — Equifax, Experian, and TransUnion. It is free, takes about ten minutes per bureau online, and blocks new-account fraud cold. This is the single highest-leverage step when SSNs are exposed.
2. Enroll in the credit monitoring Western Wayne is offering if you received a notification letter. The enrollment deadline is on your letter; missing it forfeits the benefit.
3. Request an Identity Protection PIN (IP PIN) from the IRS at irs.gov/ippin. It is free and prevents fraudulent tax returns being filed under your SSN.
4. Watch for medical identity theft. Review Explanation of Benefits statements from your health insurer. If you see services, providers, or dates of care you do not recognize, report them to the insurer and to HHS OCR.
5. Be skeptical of phone, text, and email outreach. Threat actors often follow healthcare breaches with targeted phishing using the leaked identifiers. The practice will not ask for your full SSN, account passwords, or banking details over the phone.
6. Keep your notification letter. It is the documentary basis for joining any class action, contesting fraudulent charges, or filing an IRS identity-theft affidavit (Form 14039).
7. Stop the ongoing flow of your primary care data. HealthConsent files HIPAA restriction requests so the medical and financial information exposed in this breach is not continuously re-shared with insurers, data brokers, and downstream health networks without your knowledge.

Continue reading

• Your HIPAA rights — what you can demand from any covered entity
• Browse all tracked healthcare data breaches

Sources

• HHS Office for Civil Rights Breach Portal
• ClaimDepot — Western Wayne Family Physicians: 62,000 Affected by Data Breach
• ClaimDepot — Western Wayne Family Physicians Data Breach Investigation (Shamis & Gentile)
• Strauss Borrelli PLLC — Western Wayne Physicians Data Breach Investigation
• The Lyon Firm — Western Wayne Physicians Data Breach Investigation
• Markovits, Stock & DeMarco, LLC — Western Wayne Physicians Data Breach Class Action Lawsuit Investigation
• Arnold Law Firm — Western Wayne Family Physicians Data Breach
• National Law Review / Levi & Korsinsky, LLP — Western Wayne Family Physicians Data Breach Investigation
• HIPAA Journal — March 2025 Healthcare Data Breach Report
• calHIPAA — Healthcare Data Breach Report, March 2025