The 2025 Waterford Surgical Center data breach involved suspicious activity detected in the surgical center's network on or about September 3, 2025. Waterford says an unauthorized actor accessed the network and acquired files, some of which contained patients' protected health information.
The U.S. Department of Health and Human Services Office for Civil Rights recorded the event as a hacking/information-technology incident involving a network server and reported 9,000 affected individuals.
Verified Incident TimelineWaterford detected suspicious activity on or about September 3, 2025, secured the environment, and began an investigation with cybersecurity specialists. On January 22, 2026, the center determined that some patient information may have been affected. The public notice does not identify the person or group responsible.
What Information May Have Been Affected?The information varied by person and may have included names, Social Security numbers, dates of birth, medical or health information, treatment or diagnostic information, health-insurance information, billing or payment information, and credentialing information. Waterford says it had no evidence of misuse as of the notice date.
Response and Recommended StepsWaterford says it implemented stronger password requirements, more frequent password changes, reduced access permissions, and offline storage for older data. People whose Social Security number or payment information was involved should monitor credit reports and account activity; those whose health information was involved should review unfamiliar services and insurance claims.