Anne Arundel Dermatology data breach: what happened and what to do
Anne Arundel Dermatology, a Maryland dermatology practice, reported a breach that affected 1,905,000 people. An intruder could have accessed its network from February 14 to May 13, 2025. Names, addresses, dates of birth, medical information and health insurance information were involved.
View all 13,115 breaches- Breach date
- 14 Feb 2025
- Affected
- 1,905,000
- Data exposed
- Names, Physical addresses, Dates of birth, Medical information, Health insurance information
- Last updated
Anne Arundel Dermatology is a dermatology practice in Maryland. In 2025 it told regulators that an unauthorized party had been in its network. The U.S. Department of Health and Human Services lists the incident as a hacking or IT incident affecting 1,905,000 people, which made it one of the largest healthcare breaches reported that year.
What happened
According to the practice's notice, an intruder could have accessed its network between February 14 and May 13, 2025. The investigation found that some of the files on the network contained personal and health information. The practice said it could not tell whether anyone actually viewed or copied the files, and that it was not aware of any misuse. Affected people were offered 24 months of identity protection.
What was exposed
The notice lists names, addresses, dates of birth, medical information and health insurance information. Not every person had every item exposed.
What that means for you
A name, address and date of birth together are the core of an identity theft attempt: opening credit in your name, filing false tax returns, or passing a phone verification. Insurance details can be used for medical identity theft, where someone gets care or files claims under your name. Medical information also makes phishing more convincing, because a message that mentions your real clinic or a real treatment sounds legitimate.
Settlement
A later HIPAA Journal report says the practice agreed to pay $2.4 million to settle a consolidated class action. The claim deadline was July 8, 2026 and has passed.
What to do if you were in it
- 1
Read your notice and the explanation of benefits from your insurer
If you got a letter, it explains what was involved for you. Check insurer statements for visits or claims you don't recognize and report them to the insurer.
- 2
Freeze your credit at all three bureaus
A freeze at Equifax, Experian and TransUnion is free and stops new accounts from being opened in your name. Lift it temporarily when you apply for credit.
- 3
Use the identity protection offered in your notice
The practice offered 24 months of identity protection. Enroll if you received a code, and keep an eye on your credit reports for accounts you didn't open.
- 4
Expect phishing that mentions Anne Arundel Dermatology
Names, emails and phone numbers let scammers write believable messages. Treat unexpected emails and texts that mention Anne Arundel Dermatology or your orders with suspicion, and go to the site directly instead of clicking links.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data appears, so you hear about the next one early. It can't remove data from a breach, so the alert is the useful part.
Frequently asked
Was I affected by the Anne Arundel Dermatology breach?
The practice sent notices to the people whose information was in the affected files. HHS lists 1,905,000 people in total. If you were a patient and didn't get a letter, contact the practice to ask.
What information was exposed?
Names, addresses, dates of birth, medical information and health insurance information, per the practice's notice. The mix varies by person.
Is there a settlement?
Yes. HIPAA Journal reports a $2.4 million class action settlement. The claim deadline of July 8, 2026 has passed.
Should I freeze my credit?
Yes, if your date of birth and address were involved. A freeze at the three bureaus is free and doesn't affect your credit score.
Sources
Something wrong or out of date? Tell us and we'll re-check it.