DataBreaches.Net

Menu
  • About
  • Breach Notification Laws
  • Privacy Policy
  • Transparency Report
Menu

Another plastic surgery practice fell prey to a cyberattack that acquired patient photos and info

Posted on October 27, 2025 by Dissent

Another plastic surgeon has become the victim of a cyberattack that involved patient information and photographs.

On October 23, Michael R. Schwartz, MD, FACS, notified the California Attorney General’s Office that, on August 25, they became aware of remote, unauthorized access to one of their computers. Investigators found that an unauthorized party had accessed patient files between January 20 and August 26.

Dr. Schwartz’s notification letter did not disclose the number of patients whose records were accessed, but noted that the types of information for each patient might include names, Social Security numbers (if provided), addresses, email addresses, phone numbers, photographs, and medical record numbers.

In response to the incident, Dr. Schwartz engaged leading cybersecurity experts to investigate and assess the full scope of the incident and to help strengthen their security controls. “We have since replaced all office computers and servers, enhanced our network protections, and implemented additional staff training on data security practices,” he writes.

Dr. Schwartz is also offering those affected complimentary access to Experian IdentityWorksSM for 12 months.  Additional resources can be found in the substitute notice on his website.

Was There Any Ransom Demand?

DataBreaches has been reporting on attacks against plastic surgery practices since 2017. Many of the incidents reported by this site involved ransom or extortion demands—some involved leak sites with nude photographs and details of named patients. DataBreaches found two leak sites with nude photographs of patients and medical information that are still online. One is from a 2023 incident, and the other is from a 2024 incident. Class-action lawsuits against the plastic surgery practices involved are still winding their way through the courts.

For a partial chronology of cyberattacks involving plastic surgery practices, see “A Brief Chronology of Cyberattacks on Plastic Surgery Practices.” For details on some of them, search DataBreaches.net.

Dr. Schwartz’s notification letter does not reveal the identity of the attacker(s) or whether there was any ransom or extortion demand.

As of this publication, no group has publicly claimed responsibility for this attack. Although Dr. Schwartz indicates that this incident was reported to HHS, HHS has not updated its public leak site in more than a month.

DataBreaches contacted Dr. Schwartz through his website to ask (1) whether any nude photographs of patients had names attached to them, and (2) whether he had received any ransom or extortion demands. His office did not reply immediately, but this post will be updated if a reply is received.


*NOTE:  As far as we know, the plastic surgery practice of Michael R. Schwartz, MD, FACS, in California is unrelated to that of Jaime S. Schwartz, MD, FACS. The latter is also in California and was the victim of two cyberattacks with ransom demands.  


Related:

  • Plastic surgeons often store nude photos of patients with their identity information. When would we call that "negligent?"
  • Another plastic surgery practice appears to have been hit -- this time by Hunters International (5)
  • Now a third plastic surgery practice has nude patient photos leaked
  • More plastic surgery patients have their nude photos and information leaked
Category: Health DataHIPAAOf NoteU.S.

Post navigation

← How a hacking gang held Italy’s political elites to ransom
US declines to join more than 70 countries in signing UN cybercrime treaty →

Now more than ever

"Stand with Ukraine:" above raised hands. The illustration is in blue and yellow, the colors of Ukraine's flag.

Search

Browse by Categories

Recent Posts

  • Checkout.com Discloses Data Breach After Extortion Attempt
  • Washington Post hack exposes personal data of John Bolton, almost 10,000 others
  • Draft UK Cyber Security and Resilience Bill Enters UK Parliament
  • Suspected Russian hacker reportedly detained in Thailand, faces possible US extradition
  • Did you hear the one about the ransom victim who made a ransom installment payment after they were told that it wouldn’t be accepted?
  • District of Massachusetts Allows Higher-Ed Student Data Breach Claims to Survive
  • End of the game for cybercrime infrastructure: 1025 servers taken down
  • Doctor Alliance Data Breach: 353GB of Patient Files Allegedly Compromised, Ransom Demanded
  • St. Thomas Brushed Off Red Flags Before Dark-Web Data Dump Rocks Houston
  • A Wiltshire police breach posed possible safety concerns for violent crime victims as well as prison officers

No, You Can’t Buy a Post or an Interview

This site does not accept sponsored posts or link-back arrangements. Inquiries about either are ignored.

And despite what some trolls may try to claim: DataBreaches has never accepted even one dime to interview or report on anyone. Nor will DataBreaches ever pay anyone for data or to interview them.

Want to Get Our RSS Feed?

Grab it here:

https://databreaches.net/feed/

RSS Recent Posts on PogoWasRight.org

  • OpenAI fights order to turn over millions of ChatGPT conversations
  • Maryland Privacy Crackdown Raises Bar for Disclosure Compliance
  • Lawmakers Warn Governors About Sharing Drivers’ Data with Federal Government
  • As shoplifting surges, British retailers roll out ‘invasive’ facial recognition tools
  • Data broker Kochava agrees to change business practices to settle lawsuit

Have a News Tip?

Email: Tips[at]DataBreaches.net

Signal: +1 516-776-7756

Contact Me

Email: info[at]databreaches.net
Security Issue: security[at]databreaches.net
Mastodon: Infosec.Exchange/@PogoWasRight
Signal: +1 516-776-7756
DMCA Concern: dmca[at]databreaches.net
© 2009 – 2025 DataBreaches.net and DataBreaches LLC. All rights reserved.