The photograph cost five hundred dollars. The list inside it cost six thousand people their names.

Marisol is seventy-one. She managed the cafeteria at a public school in Hialeah for thirty-one years and retired the year her knees told her to. She keeps her Medicare card in a small zippered pouch inside her purse, next to a folded prayer card and a receipt from the pharmacy she has been meaning to throw away.

On the morning of her appointment she sits in the exam room with the pouch on her lap. The nurse takes her blood pressure. The doctor asks about her sugar. She answers in the polite, careful voice she uses with anyone holding a clipboard. When she leaves, she puts the card back in the pouch and the pouch back in the purse and the purse over her shoulder, and she does not think about the card again.

She does not see the back office. She does not see the man with the phone.

According to a federal indictment unsealed this week in the Southern District of Florida, that is where her name went. Not the front desk. Not the billing department. A back office, a chart pulled up on a screen, and a personal cellphone held over it like a camera over a recipe card.

The indictment names two people. Joan Navarro Bruguet, 51, of Miami, a former employee of a regional healthcare provider the government calls Provider A. And Kenia Marrero, 46, of Miami, who prosecutors say was the buyer.

The U.S. Attorney's Office for the Southern District of Florida announced the charges on June 9, 2026. The conspiracy, the government says, ran from January 2022 through February 2025. Three years. Read that slowly. Three years of a man with access to patient charts, and a phone, and a contact in his messages.

Here is how prosecutors say it worked.

Navarro Bruguet allegedly opened patient files at Provider A. Names. Dates of birth. Medicare beneficiary identifier numbers. The Medicare BIN is the number printed on the card in Marisol's pouch. It is the key that unlocks her benefits. It is also, in the hands of a stranger, the key that unlocks claims billed in her name for equipment she will never see.

He photographed the screen. He sent the images through an encrypted messaging app to Marrero. According to the indictment, she paid him about $500 for each batch of roughly 100 beneficiaries.

Five dollars a person. That is what Marisol's name was worth on the inside of the trade.

Marrero, prosecutors allege, then resold those lists to other operators for as much as $7,000 each. Five hundred in. Seven thousand out. The markup is the machine.

The indictment says more than 6,000 Medicare beneficiaries had their information disclosed this way. Six thousand pouches like Marisol's. Six thousand cards that never left a wallet, sitting in purses and nightstand drawers across South Florida, while the numbers on them traveled.

The government also alleges Marrero did not only resell. She used some of the lists herself, in a durable medical equipment scheme. DME is the industry term for the wheelchairs, braces, glucose monitors, and orthotic devices Medicare reimburses. It is also the industry term, in South Florida, for one of the oldest fraud playbooks on file: set up a company, bill Medicare for equipment that was never ordered, never delivered, never needed, and move the money before anyone audits the paperwork.

Prosecutors say the scheme submitted more than $5 million in fraudulent claims using the stolen identifiers. More than $460,000 was allegedly deposited into a bank account linked to a sham DME company at the center of the operation. A co-conspirator, Juan Carlos Cardella, has already been sentenced on related charges.

Picture Marisol's morning again. The nurse. The blood pressure cuff. The polite voice. Now picture the camera roll on a phone in a back office a few doors down, filling with screenshots, each one a person, each one a row in a spreadsheet, each one worth five dollars to a man who knew where the cameras were not.

That is the gap the indictment describes. The gap between how the appointment felt and what the appointment was doing.

Medical data sits at the top of the dark-market price sheet for a reason. A credit card can be canceled in a phone call. A Medicare number cannot. It is attached to a body, a medical history, a federal benefits file. The Centers for Medicare and Medicaid Services estimate that improper payments across Medicare run between three and ten percent of the program. The federal government's own number, in dollars, is sixty to one hundred billion a year. The DME corner of that universe is where the cheapest paperwork meets the slowest detection.

The detection is the part that hurts the most. Medical identity theft is often not caught for years. A claim is submitted. It pays. Another claim is submitted. It pays. The beneficiary, somewhere, is going about her life. She gets a statement in the mail that she does not read closely because the statements are confusing on purpose. The diagnosis attached to her number drifts, claim by claim, into something that is not hers.

If Marisol ever needs the medical history that her Medicare number is supposed to summarize, she may find a stranger's body inside it.

That part may be the saddest.

The indictment is an accusation. Marrero and Navarro Bruguet have been charged. They have not been convicted. Navarro Bruguet faces up to five years on the BIN conspiracy count, up to ten years on each healthcare fraud and money laundering count, and mandatory consecutive two-year terms on each aggravated identity theft charge if a jury agrees with the government. The case is being prosecuted by Assistant U.S. Attorney Eduardo Gardea, Jr., with asset forfeiture handled by Assistant U.S. Attorney Gabrielle Raemy Charest-Turken. The investigation was led by HHS-OIG Miami and FBI Miami. Provider A, the government says, cooperated early.

What the indictment cannot give back is the privacy that left the building one screenshot at a time.

Here is the ugly question. Not the exciting one. Not the courtroom one. The ugly one.

How many other back offices have a personal phone in them right now.

Marisol will not know if her name was on one of the lists. The notification, if it comes, will arrive on a sheet of paper she will read once and file in a drawer. She will not call anyone. She will put the pouch back in the purse and the purse over her shoulder, the way she always has, and she will go to her next appointment, and she will trust the nurse, and the doctor, and the room, because the alternative is not living.

The card was never the thing being stolen.

The trust was.