Florida Lung, Asthma & Sleep Specialists Breach (2025): Patient SSN & Home Address Exposed

About Florida Lung

Florida Lung, Asthma & Sleep Specialists (FLASS) is a U.S.-based pulmonary, asthma, and sleep medicine specialty practice operating five offices across the greater Orlando area in central Florida, with locations in Orlando, Winter Garden, Lake Nona, Poinciana, and Kissimmee. The practice provides pulmonary medicine, asthma management, and sleep-disorder diagnosis and treatment to a regional patient population in Orange, Osceola, and Polk counties. As a HIPAA-regulated specialty medical practice, FLASS maintains substantial volumes of protected health information including patient identity, insurance, billing, appointment, diagnostic, and treatment records, alongside sleep-study results, pulmonary-function test data, and respiratory-condition diagnoses.

Why They Hold Your Data

Pulmonary care providers collect patient identity, contact, insurance, billing, appointment, and treatment records across respiratory and clinical care workflows.

Recent Developments

Florida Lung, Asthma & Sleep Specialists experienced a network intrusion in May 2025 that was first identified through dark-web monitoring on May 20, 2025 when the Rhysida ransomware-as-a-service group claimed responsibility on its dark-web leak site. Rhysida demanded a ransom of approximately six Bitcoin, worth approximately $639,000 at the time, threatening to publish stolen patient data if payment was not made. FLASS reported the breach to the FBI and to the U.S. Department of Health and Human Services on July 9, 2025, and began notifying affected patients. The practice has not extensively detailed whether it paid the ransom. Class-action investigations by U.S. plaintiff law firms began organizing in mid-2025. Rhysida has been an active threat actor in the U.S. healthcare sector throughout 2025, with confirmed victims also including Cookeville Regional Medical Center, Heart South Cardiovascular Group, MedStar Health, MACT Health Board, and Spindletop Center.

Data Points Exposed

Breach Impact

The institutional impact on Florida Lung, Asthma & Sleep Specialists is meaningful given the practice's size and the breadth of stolen patient data referenced by the threat actor. Federal HIPAA notification obligations, an active Office for Civil Rights review, Florida attorney-general filings, and emerging class-action litigation discussions are all underway. Rhysida's public claim and threatened publication of stolen data, including reported claims of access to Social Security numbers, medical records, and passport information, creates direct evidence of broad data exposure that strengthens future litigation. The reputational impact is concentrated within the Orlando-area pulmonary-care market, where patient retention is consequential because of the long-term relational nature of pulmonary and sleep-disorder care. Operationally, the practice continues to provide patient services across its five offices.

Exploitation & Downstream Threats

• Identity theft and synthetic identity construction using government-issued IDs | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure

What You Should Do

1. Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
2. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
3. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
4. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).