Baltimore Medical System data breach: files copied July 2 to 20, 2025, and 197,201 people

Was Baltimore Medical System hit by ransomware?

BMS says not in the usual sense: the event did not include encryption of any of its systems or files. What it describes is data theft, with files accessed or copied over almost three weeks. The notice does not name a group, mention a demand or say how the intruder got in. It says BMS noticed suspicious activity on its network and then investigated with outside cybersecurity specialists, but it gives no date for that discovery.

What happened, and when?

BMS has told the public in three steps. It first posted a notice on its website on September 26, 2025 saying it was investigating, updated it on December 10, 2025, and issued the supplemental notice now on its site on March 27, 2026.

Date	What happened	Source
July 2 to July 20, 2025	Unauthorized access; files accessed or copied	BMS notice
September 26, 2025	First website notice of the investigation	BMS notice
December 10, 2025	Website notice updated	BMS notice
December 12, 2025	Report to HHS, listing 501 people	HHS portal
March 27, 2026	Supplemental notice; letters to people BMS could reach	BMS notice
September 29, 2026	Notice date in Indiana's record (197,201 in total)	Indiana record

The federal portal still lists 501 people for BMS, filed while the review was under way, against Indiana's 197,201. Indiana's notice date comes 14 months after the access ended, which the notice-delay guide puts in context.

What information was involved in the Baltimore Medical System breach?

Taken together, the files held name, contact information, date of birth, Social Security number, medical information including diagnosis and treatment, lab results, medications, Medicare or Medicaid ID number, medical record or patient ID number, health insurance information, claims information and financial account information. Each person's items vary. People who got a letter can check their insurance and benefit statements as well as their bank accounts.

How many people were affected by the Baltimore Medical System breach?

197,201 people, the total BMS reported to Indiana; 23 live in Indiana. Of the roughly 1,300 notices in Indiana's 2026 report, 40 give a larger total.

Record	What it counts	Number
Indiana attorney general	People affected in total	197,201
HHS Office for Civil Rights	People affected (filed December 12, 2025)	501
Indiana attorney general	Indiana residents	23

What is BMS doing, and what should people do?

BMS says it notified federal law enforcement and is reviewing its policies and procedures and adding administrative and technical safeguards. The notice describes no free credit monitoring. It asks people to watch account statements and free credit reports and to report anything suspicious to their bank, card company or insurer.

Item	Detail from the notice
Assistance line	855-522-7641, Monday to Friday, 8:00 a.m. to 8:00 p.m. Eastern time, excluding U.S. holidays
Mail	Attn: Inquiries, Baltimore Medical System, Inc., 5525 Eastern Avenue, suite 301, Baltimore, Maryland 21224
Email	Inquiries@bmsi.org

The guide to credit monitoring offers lists the free steps, such as a credit freeze, that do not depend on an offer in the letter. The guide to healthcare provider breach notices compares other providers' notices.

Was my information in the Baltimore Medical System data breach?

If you got a letter from Baltimore Medical System in 2026, your information was in the copied files. BMS says it is writing to people where it has contact information, and posting the notice for everyone else. If you were a patient and are not sure, the assistance line above is the place to ask.

What the documents leave open

• When BMS first noticed the suspicious activity, and how the intruder got in.
• Why the federal record still shows 501 people.
• Whether BMS offered credit monitoring in any version of its letters.