Zumpano Patricios Data Breach 2025: 279,275 Patients of Provider Clients Exposed at FL Healthcare Law Firm (Business Associate)

What happened

Zumpano Patricios, P.A. (ZP Law) is a Coral Gables, Florida healthcare law firm that represents hospital systems and physician groups in disputes with health insurance companies over payment for medical services. The firm receives patient information — typically on spreadsheets — from its provider clients as part of those payment disputes. That business model made it a HIPAA business associate holding the data of 279,275 patients across its client base.

On May 6, 2025, ZP Law detected a cyberattack on parts of its IT network. The firm immediately forced password resets, blocked external access, engaged third-party forensic investigators, and notified law enforcement. By May 14, 2025, the firm had notified its provider clients. Forensics confirmed that an unauthorized third party had accessed portions of the network where patient data was stored and may have copied files; the exact date the intrusion began was not determined.

ZP Law posted a substitute notice on zplaw.com on July 3, 2025 and filed the same day with HHS OCR and the New Hampshire Attorney General. A supplemental filing with the Massachusetts Attorney General followed on July 17, 2025, reporting 5 Massachusetts residents affected. No ransomware group has publicly claimed responsibility for the attack; no threat actor attribution is publicly confirmed as of this writing.

What was stolen

The forensic investigation confirmed the following data elements were affected, with the specific combination varying by individual:

• First and last names
• Social Security numbers (limited cases)
• Dates of birth
• Provider names
• Member ID numbers
• Health insurer information
• Dates of service
• Amounts charged by providers and payment amounts received
• Clinical coding information (limited cases)
• Medical records (limited cases)

Your notification letter specifies which subset applied to you. The combination of insurer ID, member ID, clinical codes, and provider charges is the type of dataset used for medical-identity fraud, fraudulent claim submission, and targeted phishing keyed to a real care episode.

What Zumpano Patricios is offering

ZP Law is offering 12 months of complimentary credit and dark-web monitoring through IDX, a $1 million identity-theft insurance reimbursement policy, and fully managed identity-theft recovery services. The dedicated IDX call center is 1-855-202-2485, available Monday through Friday, 9 a.m. to 9 p.m. EST (excluding major U.S. holidays). Enrollment instructions and the activation code appear in your individual notification letter.

Because ZP Law is a business associate, your notification letter may arrive from ZP Law directly or from your hospital, physician group, or health plan acting on ZP Law’s report. If you receive a letter from a provider referencing a “law firm vendor,” “outside counsel,” or an incident “first detected in May 2025,” that is this event.

Class actions

A proposed class action was filed in the U.S. District Court for the Southern District of Florida within days of notification. Named plaintiff William Manning alleged that the cybersecurity incident increased the risk of future misuse of his personal information. On November 3, 2025, Judge Beth Bloom dismissed the case and closed all proceedings at the pleading stage, before discovery, finding that allegations of increased risk did not meet the concrete-injury threshold required for Article III standing under federal law. ZP Law was defended by Nelson Mullins (lead attorneys Mark F. Raymond and Jennifer Winkler).

Multiple plaintiff firms had previously announced investigations: Strauss Borrelli PLLC, Federman & Sherwood, Levi & Korsinsky LLP, Schubert Jonckheer & Kolbe, and Siri & Glimstad / SLFLA. The underlying HHS OCR investigation is unaffected by the federal civil dismissal. No appeal or refiling has been publicly confirmed as of this page’s last update.

What to do

1. Enroll in IDX credit monitoring if you have not done so. Call 1-855-202-2485 or use the activation code in your notification letter. The $1 million reimbursement policy and managed recovery services have value even if you see no immediate misuse.
2. Freeze your credit at all three nationwide bureaus (Equifax, Experian, TransUnion) if SSN was in your exposure set. Freezes are free, reversible, and stop new-account fraud cold.
3. Review explanation-of-benefits (EOB) statements from your insurer for services you did not receive. The exposed dataset, combining clinical codes, member IDs, and charge amounts, is structured for fraudulent claim submission, not just credit fraud.
4. File IRS Form 14039 (Identity Theft Affidavit) if your SSN was confirmed exposed. This flags your account for enhanced scrutiny and can block fraudulent tax filings.
5. Read your letter carefully. The notice distinguishes “limited cases” (SSN, clinical codes, medical records) from the broader group with billing-adjacent data only. Your specific exposure set determines your risk profile.
6. Stop the ongoing flow of your healthcare billing data. HealthConsent files HIPAA restriction requests so the insurance-dispute and clinical data exposed in this breach is not continuously re-shared across provider networks and health information exchanges.

Continue reading

• Your HIPAA rights explained
• All tracked healthcare breaches