Brown Health offers identity protection services after massive patient data breach in Mass.

More than 311,000 patients were affected after records at a Lifespan Physician Group of Massachusetts location were hacked

PROVIDENCE — Brown University Health confirmed on Thursday a data breach that compromised the personal information of hundreds of thousands of people, mostly in Massachusetts.

The incident took place in December 2025 at the Hawthorn location of the Lifespan Physician Group of Massachusetts in Dartmouth, Mass., which does business as Brown Health Medical Group — MA, the company said, adding that it had recently completed an investigation into the breach.

“We are notifying potentially affected individuals out of an abundance of caution,” a Brown University Health spokesperson said in an emailed statement. “While there is currently no evidence that any information has been misused, we are offering complimentary identity protection services.”

More than 311,000 people were affected overall, according to the US Department of Health and Human Services Office of Civil Rights, which tracks HIPAA violations. According to a Massachusetts data breach notification report, more than 290,000 patients in the state were affected.

The medical group determined that the attackers potentially accessed names, dates of birth, Social Security numbers, Government ID numbers, contact information, driver’s license numbers, medical and disability-related records, financial account information, and credit and debit card numbers. Payroll and compensation information at the practice, as well as license and credentialing information, were also compromised, according to data breach notification.

“We received a data breach notification from the Lifespan Physician Group/Brown Health and are reviewing it in accordance with our usual process,” said a spokesperson for the Massachusetts attorney general’s office.

A further 86 patients who were potentially impacted were from Vermont. The Vermont’s attorney general office said they, too, were informed of the breach.

“We did receive a notification from them in July about a breach impacting social security numbers, financial account codes, credit and debit account info, government ID numbers, and health records,” said Haley Sommer, senior adviser to the state’s attorney general, in an emailed response to queries.

Brown Health Medical Group is a physician-governed practice with a network of providers in Rhode Island and Massachusetts that is owned by Brown University Health.

Brown University Health owns the Rhode Island, the Miriam, Hasbro Children’s, Newport, and Bradley hospitals and is known for its work in neurology, cardiology, orthopedics, pediatrics, and cancer treatment and care. The system also owns Saint Anne’s Hospital in Fall River, Mass., and Morton Hospital in Taunton, Mass., both of which it acquired from the bankrupt Steward Health Care.

Material from previous Globe reporting was used in this report.