QualDerm Partners data breach: what happened and what to do

What happened

QualDerm Partners is a US company that supports dermatology practices. It serves more than 350 providers across about 158 practices in 17 states, so a patient may have visited a local clinic without knowing QualDerm sat behind it.

According to the breach notices and press coverage, unauthorized access to QualDerm's systems happened on December 23 and 24, 2025. QualDerm began mailing notification letters on February 22, 2026, nearly two months after the incident. The company reported the breach to the US Department of Health and Human Services, and the California and Washington Attorneys General also list it. No ransomware group has publicly claimed responsibility, and the attacker hasn't been identified.

How many people

HHS's breach portal lists more than 2.9 million people for this incident. Later reporting cites a higher figure of 3,117,874 people from an updated HHS filing. Washington's own list counts only Washington residents, so it is not the total. Use "about 3 million" as the working number.

What was exposed

Reports on the notice list patient names, dates of birth, doctor names, medical record numbers, dates of death, email addresses, treatment information, diagnosis information and health insurance information. Some people also had driver's license numbers exposed. Not every person had every item.

What that lets criminals do

Dermatology records are more personal than they sound. A diagnosis or treatment note can reveal a skin condition, a biopsy or a cancer screening, and that kind of detail makes pressure scams and targeted phishing more convincing. A message that names your actual doctor or treatment is hard to dismiss as spam.

Insurance details and medical record numbers can be used for medical identity theft: someone else gets care or prescriptions billed to your plan, and false entries end up in your record. A date of birth plus a driver's license number is also enough to try opening accounts or passing identity checks, so it's worth watching your credit even though the notice doesn't mention Social Security numbers.

Email addresses in the exposed data mean breach-themed phishing is likely. Expect messages that claim to be from your dermatology clinic or insurer.

The company's response

QualDerm is offering 12 months of free credit monitoring and identity theft protection to affected people, according to coverage of the notice. The enrollment steps and deadline are in your letter. Use the contact details printed there, not a link in a text or email.

If you got a letter

Sign up for the monitoring offer if you want it, and read your insurance statements closely for the next year. If you didn't get a letter but you have visited a dermatology clinic in one of the 17 states, you can ask the clinic whether it's part of the QualDerm network.