The Center for Facial Restoration

The Center for Facial Restoration operates as a facial surgery practice based in Florida, United States, providing medical services focused on facial restoration procedures. The practice serves individuals requiring surgical interventions for facial reconstruction, addressing needs stemming from trauma, congenital conditions, or other medical indications. Patient information handled by the clinic includes sensitive identification documents, contact details, medical photographs, and payment records, underscoring the confidential nature of their services. The scale of their operations is indicated by the 2019 data breach, which potentially affected up to 3,500 patients, suggesting a substantial client base within their regional market. As a specialized medical provider, the center's core competency lies in facial surgical techniques, though specific procedural details are not publicly documented. Their service scope is primarily localized to Florida, with no indication of multi-state or international reach in the available information.

In November 2019, the practice experienced a significant security incident involving a server breach that compromised extensive patient data. Cybercriminals initially targeted the clinic with ransom demands before escalating to direct extortion of individual patients, threatening public release of stolen photographs and personal information. Approximately 15 to 20 patients reported receiving such extortion attempts, highlighting the personal impact of the breach. The incident was reported to the Federal Bureau of Investigation, which launched an ongoing investigation and advised affected individuals to file complaints. Following the attack, the clinic implemented enhanced security measures, including new hardware, firewalls, and malware detection systems, to mitigate future risks. Notably, the breach complicated patient notification efforts because the practice relied on scanned paper intake forms rather than structured digital records, an operational detail that distinguished their record-keeping approach at the time. This event underscores the cybersecurity challenges faced by medical practices handling sensitive patient imagery and personal data, even as the center continued its facial restoration services post-incident.