Savetsky MD 2026 Email Breach
The Ira L. Savetsky, MD PLLC email breach concerns unauthorized access to a single employee email account.
Exposed Data Types
1 sensitive3- Protected health information
- Names
- Appointments
About This Breach
According to the practice's official statement dated 12 May 2026, it detected a potential incident on 14 January 2026, secured its accounts, and began an investigation with external cybersecurity professionals. The review found that some data in the account may have been obtained between November 2024 and January 2026. On 13 April 2026, the practice determined that the account contained protected health information.
The official statement defines the scope as patient first and last names combined with scheduling information and other information that patients emailed to the practice. This does not establish that every message was copied or that every patient had the same fields involved. The statement does not list Social Security numbers, passwords, payment cards, or bank accounts. Dates of birth, phone numbers, driver's licenses, insurance details, and photographs that appeared in the old structured list only through an independent report were therefore removed.
564 people and the local-data boundary
The live U.S. Department of Health and Human Services breach listing reports 564 people in a row dated 21 May 2026 and identifies email as the location. This is the regulatory person scope, not a local import or searchable patient record. Production has no import job or locally linked email, identity, or health dataset for this incident. The 564 value is therefore not used as totalRecords, and the import count is zero.
For people who received a notice
A direct recipient should rely on the data types in their own letter and verify unexpected requests involving appointments, health documents, or accounts through the practice's known phone number. The official statement says the incident was reported to the HHS Office for Civil Rights and law enforcement. The aggregate catalog number alone does not show that a particular person was a patient, that their email was read, or that their health information was obtained.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
