Southern Illinois Dermatology data breach: files exposed in November 2025, no monitoring offered

What happened at Southern Illinois Dermatology?

The letter says the practice opened an investigation as soon as it learned of the issue and worked with outside cybersecurity professionals. It does not describe how the incident started, or whether systems were encrypted or a demand was made.

Date	What the letter and the regulators' records say
November 20 to 28, 2025	Files may have been accessed or acquired
On or about November 28, 2025	The practice experiences the incident
March 4, 2026	Review finds personal and health information in the files
April 2, 2026	Report to HHS (160,312); logged in Massachusetts (8 residents)

The access window runs eight days, ending on the day the practice gives as the date of the incident. The report to HHS followed 29 days after the review found personal information.

What information was involved?

Southern Illinois Dermatology's sample letter names the reader and leaves the other data items blank. For the 8 Massachusetts residents in Southern Illinois Dermatology's notice, the state's record marks Social Security numbers and medical records as breached. The practice says it has no evidence of financial fraud or identity theft tied to the data.

What information was exposed in the Southern Illinois Dermatology breach?

The filed sample leaves the list blank, but The HIPAA Journal reported the items in the letters patients received: full names, addresses, dates of birth, Social Security numbers, telephone numbers, email addresses, person numbers and medical record numbers, varying from person to person. It said the investigation confirmed access to parts of the network where patient data was stored, and that files may have been copied.

Was Southern Illinois Dermatology hit by ransomware?

The practice has not said, and its letter names no attacker. The HIPAA Journal reported that a group called Insomnia claimed the attack, said it held data on more than 150,000 patients, posted samples on its leak site and then leaked the data it said it took. The group's figure is close to the 160,312 the practice reported to HHS, but the claim itself is not confirmed by the practice.

Figure	Source	Status
160,312	HHS Office for Civil Rights	Reported by the practice
More than 150,000	Insomnia group, per The HIPAA Journal	Claim
8	Massachusetts consumer affairs office	Massachusetts residents only

What does the letter offer?

No credit monitoring or identity protection service is described. Instead, the letter points readers to steps they can take themselves: a fraud alert, a security freeze and a free credit report. It also suggests guarding against medical identity theft, for example by checking the explanation of benefits statements that health insurers send.

Item	Detail from the letter
Credit monitoring	None described in the sample
Questions	A toll-free line printed on each letter, Monday to Friday, 8 a.m. to 8 p.m. Eastern Time

The guide to credit monitoring offers sets Southern Illinois Dermatology's offer beside other letters.

What the documents leave open

• What kind of incident it was and how it began; the practice has not confirmed the group's claim.
• Whether any version of the letter offers monitoring; the sample describes none.

With 160,312 people, Southern Illinois Dermatology's report is the 34th largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.