Millcreek Pediatrics 2025 Data Breach (14.1 Thousand People Affected)

The 2025 Millcreek Pediatrics data breach was a cybersecurity incident involving unauthorized access to the network of the Wilmington, Delaware pediatric practice. Millcreek Pediatrics says it detected suspicious network activity on February 25, 2025.

The U.S. Department of Health and Human Services Office for Civil Rights recorded the event as a hacking/IT incident involving a network server and reported 14,095 affected individuals.

Verified Incident Timeline

The practice says it contained the access after detecting the event and began an investigation with cybersecurity specialists. The review determined that certain files may have been accessed or acquired without authorization between February 17 and February 25, 2025. Millcreek Pediatrics completed its file findings on October 27 and began notifying affected people on November 21.

What Information May Have Been Affected?

The information varied by person but may have included full names, dates of birth, driver's-license or state-identification numbers, medical-record and patient-identification numbers, diagnoses or condition information, provider information, dates of service, healthcare-claims information, and clinical or treatment information. The notice says Social Security numbers may also have been involved for a limited number of people.

How the Practice Responded

Millcreek Pediatrics says it contained the incident, conducted a forensic investigation with outside specialists, and continued evaluating its security practices. As of the notice date, it said it had no evidence of identity theft or financial fraud related to the incident. Notice recipients whose Social Security numbers were involved were offered complimentary credit monitoring.

What Should Affected People Do?

Notice recipients should first review their individual letter to see which data types applied to them. Those offered credit monitoring should enroll before the stated deadline; other recipients should review credit reports, explanations of benefits, and insurance records for activity they do not recognize.