QualDerm Partners breach: patient information removed in a December 2025 intrusion

What happened in the QualDerm Partners breach?

QualDerm says it detected unauthorized activity on certain systems on December 24, 2025, contained it and started an investigation with a third-party forensics firm. It says it notified federal law enforcement and the regulators it is required to tell, and that it is reviewing its information security policies and procedures.

Date	What the letter and the regulators' records say
December 23, 2025	The unauthorized access begins; breach date on California's record and Washington's list
December 24, 2025	QualDerm detects the activity
February 20, 2026	Date printed on the letter
February 22, 2026	Report submitted to HHS
February 23, 2026	Notice recorded by California and Washington
February 24, 2026	Posted on the Texas attorney general's list

The letter is dated 58 days after the intrusion was detected. Federal health privacy rules allow up to 60 calendar days after discovery for telling patients. The HIPAA Breach Notification Rule entry sets out that deadline.

What information was involved?

The filed letter leaves the list of information as a blank field filled in for each patient, but it says the incident did not affect Social Security numbers, driver's license numbers or financial account information. The state lists fill in the rest. Washington records names, full dates of birth, health insurance policy or ID numbers and medical information; Texas records names, addresses, medical information, health insurance information and dates of birth. Neither lists Social Security numbers.

How many people were affected?

Regulator	What it counts	Number
HHS Office for Civil Rights	Individuals affected	2,951,318
Texas attorney general	Texans	174,837
Washington attorney general	Washingtonians	753

The report is the eighth largest among the open 2026 cases on the federal list, and the largest filed by a healthcare provider other than iRhythm and AdaptHealth.

What is QualDerm offering people who got a letter?

QualDerm offers 12 months of credit monitoring and identity protection through Cyberscout, a TransUnion company, at no cost.

Item	Detail from the letter
Provider	Cyberscout (TransUnion)
Services	Single-bureau credit monitoring, credit report and credit score; dark web monitoring
Length	12 months from enrollment
Enrollment	bfs.cyberscout.com/activate, with the unique code on the letter
Deadline	90 days from the date of the letter
Phone	1-855-522-4707, Monday to Friday, 8:00 a.m. to 8:00 p.m. Eastern time, excluding holidays

The letter also gives a postal address for questions: 5141 Virginia Way, Suite 350, Brentwood, TN 37027. The credit monitoring offers guide compares other notices.

What the documents leave open

• How the unauthorized actor got in, and whether ransomware was involved.
• Which QualDerm practices' patients are affected.
• Whether the removed information has been published.

Was my Social Security number exposed in the QualDerm breach?

The letter says no: Social Security numbers, driver's license numbers and financial account information were not affected. Washington's and Texas's records do not list Social Security numbers either.

How long do I have to enroll in QualDerm's credit monitoring?

90 days from the date on the letter. The filed copy is dated February 20, 2026, which would put the deadline around May 21, 2026; letters mailed later carry their own date.