Almeida Law Group is investigating a data breach at Murfreesboro Medical Clinic. If you were affected, contact Almeida Law Group.
About Murfreesboro Medical Clinic
Murfreesboro Medical Clinic & SurgiCenter (MMC) is a multi-specialty, physician-owned medical clinic founded in 1949 and headquartered at 1272 Garrison Drive in Murfreesboro, Tennessee. It operates more than 25 departments with over 95 physicians across multiple locations in Middle Tennessee, including sites in Manchester and Shelbyville, and offers services ranging from primary care and surgery to pediatrics, OB/GYN, and internal medicine. Because MMC provides medical care and maintains patient records, the types of information it handles—including health records and Social Security numbers—are among the most sensitive categories of personal data.
What Happened?
Murfreesboro Medical Clinic was listed in a Vermont Attorney General breach report summary published on August 27th, 2026, identifying Social Security numbers and health records as the categories of data involved. The Vermont filing very likely represents a delayed or supplemental state notification tied to the well-documented April 2023 cyberattack; no evidence of a separate new breach was found in public reporting.
On or around April 22nd, 2023, MMC discovered that what it described as a “well-known cyber extortion operation” had infiltrated its network. MMC was forced to shut down its systems and temporarily close all operations for nearly two weeks. On June 14th, 2023, MMC filed a breach notice with the U.S. Department of Health and Human Services Office for Civil Rights confirming that approximately 559,000 individuals were affected. MMC stated it was “unable to determine whether any personal information was actually accessed or removed from our network,” though the settlement agreement in subsequent litigation lists an extensive range of data categories as potentially compromised, including names, dates of birth, home addresses, phone numbers, copies of driver’s licenses, full or partial Social Security numbers, dates of service, medical and diagnostic information, medical record numbers, lab test results, procedure records, prescription details, and health insurance enrollment information. MMC stated that it does not store credit card or bank account information on its network.
The BianLian ransomware group publicly claimed responsibility for the attack, a claim confirmed by MMC’s CEO Joey Peay—though MMC itself referred to the attacker only as a “well-known cyber extortion operation” and did not publicly name BianLian in its own disclosures. MMC refused to pay the ransom or contact the threat actors. Six class action lawsuits were subsequently filed and consolidated on September 7th, 2023, into a single action—Krenk et al. v. Murfreesboro Medical Clinic and SurgiCenter—in the 16th Judicial Circuit Court of Rutherford County, Tennessee. MMC agreed to settle. The settlement received preliminary approval on September 16th, 2025, and final approval on January 16th, 2026. The claims deadline passed on April 14th, 2026. MMC denies all liability and wrongdoing.
Key Facts at a Glance
- Company or Organization: Murfreesboro Medical Clinic & SurgiCenter (MMC)
- Industry: Health Care — Multi-specialty medical practice and surgical center
- Location: Murfreesboro, Tennessee, with multiple locations in Middle Tennessee
- Incident type: Ransomware/cyber extortion attack
- Date of breach: April 22nd, 2023
- Date breach discovered: On or around April 22nd, 2023
- Date of consumer notification: June 14th, 2023 (HHS OCR filing); August 27th, 2026 (Vermont AG report)
- Total persons affected: Approximately 559,000
- Prior breach: No separate prior breaches identified
- Litigation status: Six class actions consolidated into Krenk et al. v. Murfreesboro Medical Clinic and SurgiCenter; settlement granted final approval on January 16th, 2026; claims deadline was April 14th, 2026
- Source: Vermont Attorney General breach report summary; HIPAA Journal; DataBreaches.net; ClassAction.org
What Should You Do?
If you believe your information was exposed in this breach, review your Explanation of Benefits statements and medical records for any services you did not receive, as health records and Social Security numbers were among the data categories involved. Place a fraud alert or credit freeze with the three major credit bureaus—Equifax, Experian, and TransUnion—and monitor your credit reports regularly through AnnualCreditReport.com. Watch your financial accounts and health insurance accounts closely for any suspicious activity. If you suspect your identity has been misused, report it at IdentityTheft.gov for a personalized recovery plan. Note that the settlement claims deadline has passed, but you may still have other legal options worth discussing with an attorney.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
