APDerm, the New England-based dermatology practice management network operating Adult & Pediatric Dermatology, P.C., and a portfolio of affiliated brands, was named on August 19, 2025 as a victim of the Qilin ransomware operation. The threat actor listed APDerm on its dark-web leak site, and the breach surfaced publicly through dark-web monitoring services in December 2025. Class-action investigations by U.S. plaintiff law firms began organizing shortly afterward.\n\nThe breach affected approximately 28,000 individuals. Compromised fields in the public disclosure included email addresses, phone numbers, and Social Security numbers. As a multi-brand dermatology practice network, the underlying records exfiltrated by the attackers also include identity, insurance, billing, and dermatologic diagnostic and treatment information typical of a specialty healthcare provider, beyond the more limited field set surfaced publicly.\n\nFor affected patients, the practical risk profile combines identity-fraud exposure with dermatology-specific risks. The combination of name, phone number, and Social Security number is a strong base for synthetic identity fraud, fraudulent credit applications, and identity-verification bypass. Inclusion in the dataset confirms the existence of a dermatology care relationship with one of the APDerm brands, which can support medical-themed scams referencing real treatments, biopsies, or insurance claims. Patients of pediatric dermatology services are a particular concern because children's identity data is durably exposed and is often the basis for child-identity fraud that can go undetected for years. Affected patients should freeze credit at all three U.S. bureaus, monitor health-insurance statements, and treat unsolicited contact referencing APDerm or any partner brand with caution.

Dermatology practice networks collect patient identity, contact, insurance, billing, appointment, and treatment records across multi-location specialty care operations.

APDerm was named on August 19, 2025 as a victim of the Qilin ransomware operation, with the breach surfacing publicly on dark-web monitoring sites in December 2025. The practice has not extensively detailed the incident in public statements as of this writing. U.S. plaintiff law firms began organizing class-action investigations following the December 2025 surfacing. APDerm has a separate prior history with HIPAA enforcement: the practice paid a $150,000 settlement to the U.S. Department of Health and Human Services in 2013–2014 over an unrelated photocopier-disposal breach involving 2,200 individuals. The 2025 incident is a distinct event involving a different threat-actor pathway.