Advanced Urgent Care of the Florida Keys

Advanced Urgent Care of the Florida Keys operated as a medical clinic providing urgent care services to patients in the Florida Keys region of the United States. As an urgent care provider, its core function was to deliver walk-in medical treatment for non-life-threatening conditions, serving the local community and visitors. The organization handled sensitive patient health information as part of its standard operations, including personal details, medical histories, diagnosis descriptions, treatment codes, and scanned identification documents such as Medicare cards. This data scope placed it under significant regulatory obligations for protecting patient privacy and security.

The organization's public profile is overwhelmingly defined by a severe data security incident that occurred on March 1, 2020. It suffered a ransomware attack that resulted in the exfiltration of its patient database. Following the clinic's refusal to pay the attackers' ransom demand, the stolen data—containing the personal and medical information of over 14,000 individuals—was publicly released on a Russian-language cybercrime forum and a file-sharing platform. The compromised information included names, contact details, billing records, insurance specifics, CPT codes, medical histories, and handwritten clinical notes, with many files containing Social Security numbers. Critically, the clinic did not publicly acknowledge the breach and did not respond to inquiries about the incident, demonstrating a notable failure in incident response and transparency. This event underscores a critical vulnerability in its data protection practices and a lack of established protocols for communicating with affected patients and the public following a major security breach.