The 2026 Atlantic Brain and Spine data breach involved unusual activity detected in the organization's network on January 26, 2026. The organization, which uses the Atlantic Neurosurgical & Spine Specialists brand, says certain data on its network was accessed without authorization.
The U.S. Department of Health and Human Services Office for Civil Rights recorded the event as a hacking/information-technology incident involving a network server and reported 1,372 affected individuals.
Verified Incident TimelineAtlantic Brain and Spine detected the unusual activity on January 26, 2026, and began an investigation with third-party specialists. When the official notice was published, the organization was still reviewing the affected data set to identify the information involved and the people to whom it related.
What Information May Have Been Affected?The information may have varied by person. The official notice lists names, addresses, email addresses, telephone numbers, dates of birth, Social Security numbers, financial-account information, treatment or diagnosis information, prescription or medication information, dates of service, provider names, medical-record numbers, patient-account numbers, Medicare or Medicaid ID numbers, health-insurance information, and medical billing or claims information.
How the Organization RespondedThe organization says it investigated with third-party specialists, notified law enforcement, and reviewed its data-protection policies and procedures. The public notice does not identify the person or group responsible.
What Should Affected People Do?Notice recipients should review credit reports and financial accounts while also checking health-insurance claims, explanation-of-benefits statements, and medical bills for an unfamiliar transaction or service. If a health record looks suspicious, contact the insurer or health-care provider through a verified channel rather than a link in the message.