Lifespan Physicians Group Data Breach Exposes Over 290,000 Patient Records
In December 2025, an unauthorized actor accessed Lifespan Physicians Group’s historic server network, compromising sensitive data of over 290,000 patients. The breach, which occurred between December 15 and 16, 2025, went undetected until July 2026, when Lifespan notified affected individuals potentially violating state and federal data breach notification laws.
The exposed data includes names, dates of birth, contact details, Social Security numbers, driver’s license numbers, medical records, financial account information, and payroll data. A total of 290,357 Massachusetts residents and 86 Vermont residents were impacted, along with patients affiliated with Lifespan’s Rhode Island-based multispecialty network, Brown Health Medical Group-MA.
Lifespan reported the incident to the Massachusetts and Vermont Attorneys General on July 16, 2026. Law firm Schubert Jonckheer & Kolbe LLP has since launched an investigation into the breach, citing potential legal recourse for affected individuals due to risks of identity theft and privacy violations.
The delayed disclosure and scope of compromised data highlight ongoing challenges in healthcare cybersecurity and regulatory compliance.
Lifespan cybersecurity rating report: https://www.rankiteo.com/company/lifespanhealthsystem
"id": "LIF1785840239",
"linkid": "lifespanhealthsystem",
"type": "Breach",
"date": "12/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '290,443 (290,357 Massachusetts '
'residents, 86 Vermont '
'residents, and patients '
'affiliated with Brown Health '
'Medical Group-MA)',
'industry': 'Healthcare',
'location': 'Massachusetts, Vermont, Rhode Island',
'name': 'Lifespan Physicians Group',
'type': 'Healthcare Provider'}],
'customer_advisories': 'Notification to affected individuals',
'data_breach': {'number_of_records_exposed': '290,443',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Names',
'Dates of birth',
'Contact details',
'Social Security numbers',
'Driver’s license numbers',
'Medical records',
'Financial account information',
'Payroll data']},
'date_detected': '2026-07',
'date_publicly_disclosed': '2026-07-16',
'description': 'In December 2025, an unauthorized actor accessed Lifespan '
'Physicians Group’s historic server network, compromising '
'sensitive data of over 290,000 patients. The breach occurred '
'between December 15 and 16, 2025, and went undetected until '
'July 2026. The exposed data includes names, dates of birth, '
'contact details, Social Security numbers, driver’s license '
'numbers, medical records, financial account information, and '
'payroll data. A total of 290,357 Massachusetts residents and '
'86 Vermont residents were impacted.',
'impact': {'brand_reputation_impact': 'Potential brand reputation impact due '
'to delayed disclosure and scope of '
'compromised data',
'data_compromised': 'Sensitive patient data including names, dates '
'of birth, contact details, Social Security '
'numbers, driver’s license numbers, medical '
'records, financial account information, and '
'payroll data',
'identity_theft_risk': 'High',
'legal_liabilities': 'Potential legal recourse for affected '
'individuals due to risks of identity theft '
'and privacy violations',
'payment_information_risk': 'High',
'systems_affected': 'Historic server network'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Delayed disclosure and scope of compromised data '
'highlight ongoing challenges in healthcare cybersecurity '
'and regulatory compliance',
'references': [{'source': 'Incident disclosure'}],
'regulatory_compliance': {'legal_actions': 'Investigation launched by '
'Schubert Jonckheer & Kolbe LLP',
'regulations_violated': ['State and federal data '
'breach notification laws'],
'regulatory_notifications': ['Massachusetts '
'Attorney General',
'Vermont Attorney '
'General']},
'response': {'communication_strategy': 'Notification to affected individuals '
'and Attorneys General',
'third_party_assistance': 'Law firm Schubert Jonckheer & Kolbe '
'LLP'},
'threat_actor': 'Unauthorized actor',
'title': 'Lifespan Physicians Group Data Breach Exposes Over 290,000 Patient '
'Records',
'type': 'Data Breach'}