Baltimore Medical System Data Breach (501 People Affected)

The Baltimore Medical System data breach affected at least 501 people after an unauthorized actor accessed certain systems and copied files in July 2025.

Baltimore Medical System is a nonprofit community healthcare organization in Maryland. Its official notice specifically says no systems or files were encrypted during the incident.

What Happened in the Baltimore Medical System Breach?

After identifying suspicious network activity, the organization opened an investigation with outside cybersecurity specialists. The investigation found that an unauthorized actor accessed certain systems and copied files between July 2 and July 20, 2025.

Baltimore Medical System published an online notice on September 26, 2025, notified federal law enforcement, and continued reviewing the affected files. Public documents do not identify the initial access method or the actor.

What Information May Have Been Affected?

The official notice says the potentially affected information varied by person and could include names, dates of birth, medical information, and other demographic details.

Because the file review was ongoing when the notice was published, every field should not be assumed to apply to everyone. The official list does not confirm Social Security numbers, financial accounts, health insurance numbers, passwords, or other additional fields.

How Many People Were Affected?

The official U.S. Department of Health and Human Services breach portal reports 501 affected individuals. Because the organization was still reviewing the scope, the published figure should be treated as a confirmed lower bound.

What Should Affected People Do?

Notice recipients should rely on the data scope in their own letters and review benefit statements and medical records for unfamiliar services, providers, or charges.

The organization's notice recommends monitoring account statements and credit reports for unusual activity. Unexpected messages using the Baltimore Medical System name should be verified independently, and additional measures should be based on the data identified in the person's own notice.