Millcreek Pediatrics Reports Major Data Breach Affecting 14,095 Patients Millcreek Pediatrics, a Wilmington, Delaware-based pediatric practice, disclosed a significant data breach that may have exposed the personally identifiable information (PII) and protected health information (PHI) of 14,095 current and former patients nationwide. The breach was first detected on February 25, 2025, after suspicious activity was identified within the practice’s systems. A subsequent investigation, supported by cybersecurity experts, determined that unauthorized access occurred between February 17 and February 25, 2025, during which sensitive files were potentially accessed or exfiltrated. The compromised data includes full names, dates of birth, driver’s license and state ID numbers, medical record numbers, diagnosis details, treatment information, and healthcare claims data. For some individuals, Social Security numbers were also exposed, heightening the risk of identity theft and medical fraud. Millcreek Pediatrics publicly acknowledged the incident on November 21, 2025, posting a Notice of Data Security Incident on its website and reporting the breach to the U.S. Department of Health and Human Services. Affected individuals began receiving notifications on the same date. In response, the practice contained the breach, conducted a forensic investigation, and engaged cybersecurity experts to assess the scope of the incident. Those whose Social Security numbers were compromised were offered complimentary credit monitoring services. A dedicated response line (833-426-5702) was also established for impacted individuals.