Anne Arundel Dermatology (a Maryland-based multi-site dermatology practice) disclosed a data breach affecting approximately 1.9 million individuals. Attackers maintained unauthorized access to the network for approximately three months, from February 14 to May 13, 2025. Exposed data included names, addresses, dates of birth, medical information, and health insurance information. Notifications were issued beginning July 2025 with 24 months of identity protection services offered. No threat actor claimed responsibility. Anne Arundel Dermatology agreed to a $2.4 million class action settlement alleging negligent failure to protect patient data.