Baltimore Medical System Data Breach

After identifying suspicious network activity, the organization opened an investigation with outside cybersecurity specialists. The investigation found that an unauthorized actor accessed certain systems and copied files between July 2 and July 20, 2025.

Baltimore Medical System published an online notice on September 26, 2025, notified federal law enforcement, and continued reviewing the affected files. Public documents do not identify the initial access method or the actor.

The official notice says the potentially affected information varied by person and could include names, dates of birth, medical information, and other demographic details.

Because the file review was ongoing when the notice was published, every field should not be assumed to apply to everyone. The official list does not confirm Social Security numbers, financial accounts, health insurance numbers, passwords, or other additional fields.

The official U.S. Department of Health and Human Services breach portal reports 501 affected individuals. Because the organization was still reviewing the scope, the published figure should be treated as a confirmed lower bound.

Notice recipients should rely on the data scope in their own letters and review benefit statements and medical records for unfamiliar services, providers, or charges.

The organization's notice recommends monitoring account statements and credit reports for unusual activity. Unexpected messages using the Baltimore Medical System name should be verified independently, and additional measures should be based on the data identified in the person's own notice.