Skip to content

Frederick Health

Disclosed Jan 27, 20251 year ago934,326 affectedConfirmed

Official notice

Ransomware attack on Frederick Health exposes data of 934,326 patients

Maryland's Frederick Health said a ransomware attack detected on January 27, 2025 let an intruder copy files from a file share server containing patient names, SSNs, driver's license numbers, medical record numbers and insurance data; HHS lists 934,326 affected.

What is known

People affected934,326 (as reported to HHS)
DisclosedJan 27, 2025
DiscoveredJan 27, 2025
AttackRansomware
Data exposedNames, Health, Addresses, Dates of birth, Social Security numbers, Government IDs, Insurance
SectorHealthcare · US
StatusConfirmed

Sources

Source
HHS OCR breach report: Frederick Health (Healthcare Provider, MD)ocrportal.hhs.gov · Official notice
Frederick Health data breach impacts nearly 1 million patientsbleepingcomputer.com · News
Largest Healthcare Data Breaches of 2025hipaajournal.com · News

Notices filed

WhereFiledPeople
ResearchtotalJan 27, 2025934,326
HHS OCRtotalMar 28, 2025934,326
History of this record
  • 2026-09-25 · attack: hacking to ransomware · seed source
  • 2026-09-25 · data_types: ["names","health"] to ["names","health","addresses","dob","ssn","government-id","insurance"] · seed source
  • 2026-09-25 · disclosed: 2025-03-28 to 2025-01-27 · seed source
  • 2026-09-25 · discovered: empty to 2025-01-27 · seed source
  • 2026-09-25 · summary: empty to Maryland's Frederick Health said a ransomware attack detected on January 27, 2025 let an intruder copy files from a file share server containing patient names, SSNs, driver's license numbers, medical record numbers and insurance data; HHS l · seed source
  • 2026-09-25 · title: empty to Ransomware attack on Frederick Health exposes data of 934,326 patients · seed source
  • 2026-09-25 · added · backfill source

First seen 2026-09-25 (HHS OCR), confirmed by HHS OCR. Record counts are as reported. Not legal advice.

Everything about Frederick Health

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.