Florida Orthopaedic Institute floridaortho.com

Florida Orthopaedic Institute data breach: what happened and what to do

A ransomware attack on Florida Orthopaedic Institute in April 2020 exposed health and identity data of more than 600,000 people, per HHS: names, addresses, birth dates, driver's license numbers, diagnoses and medications.

View all 13,177 breaches

Breach date: 6 Apr 2020
Made public: 22 Jun 2020
Data exposed: Names, Physical addresses, Dates of birth, Driver's licenses, Claims information, Diagnoses, Medical conditions, Laboratory results, Medications
Last updated: 30 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

Florida Orthopaedic Institute, a large orthopedic practice in Tampa, reported that a ransomware attack in April 2020 hit its servers. Ransomware is malware that locks a company's files until it pays, and attackers often steal copies of the files first. According to news reports, the practice found the attack in early April 2020 and sent notification letters in June 2020.

Sources checked: ocrportal.hhs.gov, hipaajournal.com, scworld.com

Last verified against the official page: 30 Oct 2026

How we research this Report an error

How many people and what was exposed

The practice reported the incident to the U.S. Department of Health and Human Services as affecting more than 600,000 people. HHS's description says the information involved included names, addresses, dates of birth, driver's license numbers, claims information, diagnoses, medical conditions, laboratory results and medications. Some news reports also mention Social Security numbers.

What that means for you

A name, address and date of birth are the core of an identity. Add a driver's license number and criminals can open accounts or file fake tax returns in your name. Diagnoses and medications also make medical-themed phishing look real, so a message about a prescription or a claim deserves a second look.

The company's response

HHS says the practice added technical safeguards, trained employees and offered identity restoration services. News outlets later reported that it agreed to pay $4 million to settle a class action over the incident, without admitting wrongdoing.

What to do if you were in it

1

Freeze your credit

A credit freeze is free and blocks most new accounts in your name. Place it separately at Equifax, Experian and TransUnion, as the FTC explains.
2

Read your insurance statements

Check explanation of benefits statements for treatment or claims you don't recognize and tell your insurer about them.
3

Expect medical-themed phishing

Be wary of calls, emails and texts about claims, prescriptions or bills. Contact the practice or insurer using a number you already trust.
4

Report identity theft if it happens

If someone misuses your information, report it at IdentityTheft.gov to get a recovery plan.
5

Check whether your email or phone is in this and other breaches

Run a free Serus scan to see which breaches include your details. Serus alerts you when you show up in a new one.

Official filings

U.S. Department of Health and Human Services , filed 22 Jun 2020 : 651,527 people

Timeline

6 Apr 2020
The breach happened
22 Jun 2020
The company made it public
22 Jun 2020
Reported to U.S. Department of Health and Human Services

Frequently asked

Was I affected by the Florida Orthopaedic Institute breach?

The practice sent letters in 2020 to the people it identified. If you were a patient and didn't get one, contact the practice.

What was exposed?

HHS lists names, addresses, dates of birth, driver's license numbers, claims information, diagnoses, medical conditions, laboratory results and medications.

Is there a settlement?

News reports say the practice agreed to pay $4 million to resolve a class action. Check the settlement notice for deadlines and eligibility.