Florida Hand Center, a specialized medical practice in Southwest Florida, suffered a targeted ransomware attack by the RHYSIDA group on July 8, 2025. The breach resulted in the theft of personally identifiable information (PII) and protected health information (PHI), including patient and employee data such as names, dates of birth, contact details, Social Security numbers, driver’s license/state ID numbers, medical records, health insurance details, and billing/payment data. The attackers posted proof-of-access screenshots on the dark web, confirming the exfiltration of sensitive data. While the exact number of affected individuals remains undisclosed, the breach exposes victims to identity theft, financial fraud, and medical data misuse. Florida Hand Center is legally obligated to issue state/federal disclosures and notify impacted individuals via mail. The incident underscores severe risks to patient privacy, financial security, and operational trust, with potential long-term reputational and regulatory consequences for the practice.
Source: https://www.claimdepot.com/data-breach/florida-hand-center-2025
TPRM report: https://www.rankiteo.com/company/florida-hand-center
"id": "flo0132201091625",
"linkid": "florida-hand-center",
"type": "Ransomware",
"date": "7/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization’s existence"{'affected_entities': [{'industry': 'healthcare',
'location': 'Southwest Florida, USA',
'name': 'Florida Hand Center',
'type': 'medical practice'}],
'customer_advisories': ['Review notices from Florida Hand Center.',
'Monitor financial accounts and credit reports.',
'Place fraud alerts or credit freezes if necessary.',
'Avoid sharing personal information in response to '
'unsolicited requests.'],
'data_breach': {'data_exfiltration': True,
'personally_identifiable_information': True,
'sensitivity_of_data': 'high',
'type_of_data_compromised': ['personally identifiable '
'information (PII)',
'protected health information '
'(PHI)']},
'date_publicly_disclosed': '2025-07-08',
'description': 'Florida Hand Center, a specialized medical practice in '
'Southwest Florida, experienced a major data breach and '
'ransomware attack. The RHYSIDA ransomware group claimed '
'responsibility, posting on the dark web that they had hacked '
'the center’s systems and stolen sensitive data, including '
'personally identifiable information (PII) and protected '
'health information (PHI). Exposed data may include names, '
'dates of birth, contact information, Social Security numbers, '
"driver's license and state ID numbers, medical records, "
'health insurance details, and billing or payment data. The '
'cybercriminals provided sample screenshots as proof of '
'access, indicating a significant and targeted breach. The '
'total number of affected individuals has not been disclosed.',
'impact': {'data_compromised': ['personally identifiable information (PII)',
'protected health information (PHI)',
'names',
'dates of birth',
'contact information',
'Social Security numbers',
"driver's license numbers",
'state ID numbers',
'medical records',
'health insurance details',
'billing or payment data'],
'identity_theft_risk': 'high',
'payment_information_risk': 'high'},
'initial_access_broker': {'data_sold_on_dark_web': True},
'ransomware': {'data_exfiltration': True, 'ransomware_strain': 'RHYSIDA'},
'recommendations': ['Carefully review any notice or communication from '
'Florida Hand Center.',
'Monitor financial accounts and credit reports for signs '
'of identity theft.',
'Consider placing fraud alerts or credit freezes with '
'major credit bureaus.',
'Be cautious of unsolicited emails or phone calls '
'requesting personal information.'],
'regulatory_compliance': {'regulatory_notifications': ['state disclosures',
'federal disclosures']},
'response': {'communication_strategy': ['mandated state and federal '
'disclosures',
'notification to affected individuals '
'by mail']},
'threat_actor': 'RHYSIDA',
'title': 'Florida Hand Center Data Breach and Ransomware Attack',
'type': ['data breach', 'ransomware attack']}