What Happened
# BMS Data Breach Summary Based on the search results, there appear to be multiple BMS entities affected by separate data breaches in 2025-2026. The most prominent incident involved Baltimore Medical System (BMS), which suffered a ransomware attack between July 2-20, 2025, perpetrated by the Brain Cipher ransomware gang, exposing sensitive personal and medical information for approximately 90,000 patients including names, Social Security numbers, dates of birth, medical records, lab results, and insurance details; the breach was discovered in late 2025 and BMS began notifying affected individuals in March 2026. Additionally, BMS Holdings LP (BMS CAT), a disaster recovery company, experienced a separate data breach in February 2025 affecting 28,454 current and former employees’ names and Social Security numbers, which resulted in an $825,000 class action settlement with a claim deadline of July 8, 2026. A third incident involved Bristol Myers Squibb (bms.com), a pharmaceutical company, which was reportedly targeted by APT73 ransomware in April 2026, though limited details are available about this breach.
