Austin Plastic and Reconstructive Surgery Data Breach Investigation

Austin Plastic and Reconstructive Surgery notified affected patients in March 2026 about a ransomware incident that took place nearly nine months earlier. Contact our data breach lawyers to investigate your claim.

What Happened?

According to the practice's own notification to patients, unauthorized access to its computer network occurred between June 30 and July 1, 2025. The breach was attributed to a ransomware attack, and cybersecurity reports have linked the incident to a threat actor known as "3AM."

While the network intrusion took place in the summer of 2025, the practice did not confirm the scope of the compromised data until February 28, 2026, and did not begin notifying affected individuals until March 11, 2026.

Under the Health Insurance Portability and Accountability Act, or HIPAA, covered entities are generally required to notify affected individuals within 60 days of discovering a breach.

What Data Was Compromised?

The review of affected files confirmed that the following categories of information may have been accessed or acquired by unauthorized parties:

• Full names and home addresses
• Dates of birth
• Social Security numbers
• Driver's license numbers and state identification numbers
• Passport numbers
• Financial account information
• Medical records and treatment information
• Health insurance information

Why Plastic Surgery Practices Are Targeted

Plastic surgery practices face a distinct set of risks. The FBI has previously issued warnings specifically about cybercriminals targeting plastic surgery offices because of the sensitive nature of the records they maintain, including clinical photographs and detailed personal histories. This combination gives threat actors additional leverage beyond standard ransomware extortion.

Ransomware attacks on healthcare organizations have increased dramatically over the past several years. According to federal data tracked by the HHS Office for Civil Rights, ransomware-related breaches reported to regulators rose by more than 260 percent between 2018 and recent reporting years.

‍HIPAA violations can serve as evidence of negligence in civil claims brought under state law. Class action litigation is a common avenue for affected patients to seek collective compensation without bearing the full cost of individual lawsuits.

Why Contact The Lyon Firm?

The Lyon Firm represents clients nationwide in data breach class action cases, including those involving healthcare providers and medical practices. With nearly two decades of experience in complex litigation against large institutions, The Lyon Firm has the knowledge and resources to evaluate your claim and pursue accountability on your behalf.

If you or a loved one received a notice from Austin Plastic and Reconstructive Surgery, you may be entitled to compensation. Contact The Lyon Firm today for a free, confidential consultation. There is no cost to speak with an attorney, and no fee unless your case is successful.