Mid America Physician Services 2024 Data Breach

The primary incident narrative is the Notice of Data Security Incident issued for MAPS on July 15, 2025. It explains that the organization discovered a network event, investigated with third-party cybersecurity specialists, and identified exposure of certain patient information as a result. The notice also says law enforcement was informed.

The HHS OCR row records Mid America Physician Services as a Healthcare Provider, classifies the event as a Hacking/IT Incident, and identifies Network Server as the information location; the exact affected total is 104,513. The Texas Attorney General data-security portal publishes identity and financial categories for the event. Corporate identity is additionally established by Johnson County OB/GYN's official site, which calls itself a division of Mid America Physician Services LLC and displays the official MAPS logo.

MAPS discovered a network incident affecting its information technology systems on or about November 14, 2024. It immediately engaged outside cybersecurity specialists to assess, contain, and remediate the event. The incident date is based on the earliest technical activity that can be verified from public sources.

The file review concluded around May 8, 2025 and identified the types of exposed patient information. The company published its public notice on July 15, explaining that potentially affected individuals were being notified and given protective resources. The January 13, 2025 date on the HHS row is the federal report date and is not treated as the start of the incident.

The confirmed general list in the MAPS notice consists of names, addresses, dates of birth, medical treatment information, billing information, and health insurance information. The Texas regulatory record adds Social security numbers and financial information. Unverified person counts, data fields, and threat-actor claims are not treated as part of the public incident scope.

The organization did not say that every patient had the same combination. Treatment and insurance information can enable medical-identity abuse, while Social Security and financial information can support identity or account fraud. The entry preserves the sources' finding of exposure without claiming that files were publicly released, sold, or acquired by a named threat group.

The affected-person or record count published by the official source represents the reported scope of the incident. It does not mean that every disclosed data category applied to every person. That figure represents individuals in the notification scope, not a count of exposed files, rows, or fields. One person may have several data elements involved, while another may have only part of the published list.

Mid America Physician Services operates through four clinical divisions: Johnson County OB/GYN, Women's Care, Women's Clinic of Johnson County, and Women's Health Associates. Because those brands are part of the same MAPS event, they are not created as separate breach entries. The duplicate guard covers all names so searches for any clinic resolve to one verified incident.

After identifying the event, the company worked with outside specialists on assessment, containment, and remediation and notified law enforcement. MAPS said it took additional steps to reduce the likelihood of a similar event but did not publish the technical details of those controls. LeakData does not invent undisclosed security measures.

The investigation had identified no fraud or identity theft resulting from the incident when the notice was issued. That finding describes the known status at notification and does not guarantee that sensitive identity, health, or financial data will never be misused. The company said it was providing affected people with protective resources and continuing its information-security work.

Notice recipients should rely on the fields identified in their individual letter and review credit reports, bank accounts, bills, and health-insurance explanations of benefits regularly. If an unfamiliar medical service, treatment, insurance claim, or collection appears, contact the provider and insurer through previously known official contact details.

People whose Social security numbers or financial information were involved may consider free fraud alerts and credit freezes. Links in unexpected calls, emails, or payment requests using the names of MAPS or its affiliated clinics should not be opened directly.