APDerm Dermatology Practice Network Breach (2025): Patient SSN Exposed

About apderm.com

APDerm, formally Adult & Pediatric Dermatology, P.C., is a U.S.-based dermatology practice management group headquartered in Acton, Massachusetts. Founded in 1992 and backed by private equity firm Waud Capital Partners, APDerm operates as a network of physician-led dermatology practices across New England, with clinical locations spread across Massachusetts and New Hampshire. The network includes more than a dozen partner brands such as Adult & Pediatric Dermatology, Boston Dermatology and Laser Center, Mystic Valley Dermatology Associates, Coastal Dermatology, and Pioneer Valley Dermatology. Across the network, APDerm provides medical, surgical, cosmetic, and pediatric dermatology services. As a HIPAA-covered specialty healthcare network, APDerm holds substantial volumes of protected health information including patient identity, insurance, billing, diagnostic, and dermatologic treatment records.

Why They Hold Your Data

Dermatology practice networks collect patient identity, contact, insurance, billing, appointment, and treatment records across multi-location specialty care operations.

Recent Developments

APDerm was named on August 19, 2025 as a victim of the Qilin ransomware operation, with the breach surfacing publicly on dark-web monitoring sites in December 2025. The practice has not extensively detailed the incident in public statements as of this writing. U.S. plaintiff law firms began organizing class-action investigations following the December 2025 surfacing. APDerm has a separate prior history with HIPAA enforcement: the practice paid a $150,000 settlement to the U.S. Department of Health and Human Services in 2013–2014 over an unrelated photocopier-disposal breach involving 2,200 individuals. The 2025 incident is a distinct event involving a different threat-actor pathway.

Data Points Exposed

Breach Impact

APDerm faces significant institutional exposure given its network scale and the prior HIPAA enforcement history. Federal HIPAA notification obligations, an Office for Civil Rights review, multistate attorney-general filings, and active class-action investigations create a substantial compliance and litigation pipeline. The 2014 photocopier-breach settlement establishes that HHS has a documented enforcement relationship with the practice, which can affect how regulators view subsequent incidents. The reputational impact concentrates within the New England dermatology market, where APDerm has been a leading multi-brand network for three decades. Operationally, the practice continues to provide patient care across its network locations.

Exploitation & Downstream Threats

• Identity theft and synthetic identity construction using government-issued IDs | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses

What You Should Do

1. Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
2. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
3. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).