32 Pearls Data Breach: 23,517 Patients Affected by Hacking Incident

On July 21, 2025, Dr. Michael Bilikas and Associates, operating under the name 32 Pearls, reported a significant data breach to the U.S. Department of Health and Human Services (HHS). The Washington-based healthcare provider disclosed that a hacking incident compromised their network server, affecting 23,517 patients.

What Happened

According to breach notification documents, 32 Pearls discovered the security incident on May 22, 2025. The breach was classified as a hacking/IT incident that targeted the healthcare provider's network server infrastructure.

While the HHS Office for Civil Rights (OCR) breach report indicates "no additional details available," patient notification letters were sent out on June 21, 2025, approximately one month after the discovery. The breach was subsequently reported to HHS on July 21, 2025, meeting the required 60-day reporting timeline under HIPAA regulations.

The incident has already attracted legal attention, with Oklahoma City-based law firm Federman & Sherwood announcing on August 8, 2025, that they are investigating the data breach for potential class action litigation.

Who Is Affected

The breach impacted 23,517 individuals who were patients of Dr. Michael Bilikas and Associates d.b.a. 32 Pearls. This makes it a significant healthcare data breach, placing it among the larger incidents reported to the HHS Wall of Shame in 2025.

Affected patients have been provided with a dedicated phone line (1-800-210-5543) to address questions and concerns about the incident.

Breach Details

Timeline of Events:

• May 22, 2025: 32 Pearls discovered the security incident
• June 21, 2025: Patient notification letters sent
• July 21, 2025: Breach reported to HHS OCR
• August 8, 2025: Law firm announces investigation

Technical Aspects:

• Breach Type: Hacking/IT Incident
• Location: Network Server
• Entity Type: Healthcare Provider
• State: Washington

The breach notification indicates that cybercriminals gained unauthorized access to the healthcare provider's network server. However, specific details about the attack method, whether ransomware was involved, or the extent of data exfiltration have not been disclosed in available public documents.

What This Means for Patients

Healthcare data breaches pose significant risks to patients due to the sensitive nature of protected health information (PHI). While the specific types of data compromised in the 32 Pearls incident haven't been detailed in public reports, typical healthcare breaches may involve:

• Personal identifiers (names, addresses, phone numbers)
• Social Security numbers
• Health insurance information
• Medical record numbers
• Treatment and diagnosis information
• Financial account details

Patients affected by this breach should remain vigilant for signs of identity theft and medical identity fraud. The establishment of a dedicated hotline suggests the healthcare provider is taking steps to address patient concerns and provide necessary support.

How to Protect Yourself

If you're a patient of 32 Pearls or believe you may be affected by this breach, consider taking these protective measures:

Immediate Actions:

1. Contact the Provider: Call 1-800-210-5543 for specific information about how the breach affects you
2. Monitor Your Accounts: Regularly check bank accounts, credit cards, and insurance statements for unauthorized activity
3. Review Medical Records: Examine explanation of benefits (EOB) statements for unfamiliar medical services

Ongoing Protection:

1. Credit Monitoring: Consider enrolling in credit monitoring services if not provided by the healthcare provider
2. Fraud Alerts: Place fraud alerts on your credit reports with major credit bureaus
3. Identity Monitoring: Watch for signs of medical identity theft, such as bills for services you didn't receive
4. Secure Communications: Be cautious of phishing attempts that may reference this breach

Documentation:

• Keep records of all communications related to the breach
• Document any suspicious activity or potential fraud
• Save copies of breach notification materials

Prevention Lessons for Healthcare Providers

The 32 Pearls incident highlights critical cybersecurity challenges facing healthcare organizations. This breach offers several important lessons for healthcare providers:

Network Security Fundamentals:

1. Server Hardening: Implement robust security configurations for network servers
2. Access Controls: Ensure proper authentication and authorization protocols
3. Network Segmentation: Isolate critical systems to limit breach impact
4. Regular Updates: Maintain current security patches and software updates

Incident Response Planning:

1. Detection Capabilities: Invest in monitoring tools for early threat detection
2. Response Procedures: Develop and test incident response plans
3. Communication Protocols: Prepare template notifications and communication strategies
4. Legal Compliance: Understand HIPAA reporting requirements and timelines

Risk Assessment:

1. Regular Audits: Conduct periodic security assessments
2. Vulnerability Testing: Perform penetration testing and vulnerability scans
3. Third-Party Risk: Evaluate business associate agreements and vendor security
4. Employee Training: Provide ongoing cybersecurity awareness education

Business Continuity:

1. Backup Systems: Implement reliable data backup and recovery procedures
2. Operational Resilience: Plan for maintaining patient care during incidents
3. Insurance Coverage: Review cyber liability insurance policies
4. Legal Preparedness: Establish relationships with cybersecurity and legal experts

The healthcare industry continues to face increasing cyber threats, making proactive security measures essential for protecting patient data and maintaining regulatory compliance.

Looking Forward

As the 32 Pearls investigation continues, affected patients should stay informed about developments and potential remediation efforts. The involvement of legal firms investigating potential class action litigation suggests this incident may have broader implications for healthcare cybersecurity standards.

Healthcare providers can learn from incidents like this by investing in comprehensive cybersecurity programs, regular risk assessments, and robust incident response capabilities. The cost of prevention is typically far less than the financial and reputational damage caused by data breaches.

Protect your practice with AI-powered HIPAA compliance. Get started with HIPAA Agent.