Climate
Privacy
Bob Dylan
Drones
Data Centers
AI Governance
2026 Maine Senate Race
Last Update: 08/01/2026 at 12:00 PM EST
Healthcare Data Breach Wave
Coverage from SecurityWeek, TechCrunch, and others
Articles
138
Active Days
568
The Topic
Healthcare organizations continue to disclose breaches that expose patient identifiers, medical records, and sometimes financial data, with ransomware, email compromise, and vendor incidents recurring across hospitals, specialty practices, and medical service providers. Notification letters, credit monitoring, and HIPAA reporting remain the standard response, while some cases involve delayed discovery, litigation, or unclear root cause.
First Article: 01/07/25
Latest Article: 07/28/26
Summary
- Healthcare breaches remain the dominant pattern, with hospitals, clinics, and medical service providers repeatedly disclosing unauthorized access to patient data.
- Ransomware and intrusion-linked incidents are common, but several cases also involve third-party vendors or compromised email systems rather than direct attacks on core medical records.
- Exposed data frequently includes names, Social Security numbers, dates of birth, driver license numbers, health insurance details, and clinical information, creating both identity theft and medical privacy risk.
- Notification timelines often lag the incident by months, and some disclosures involve delayed discovery or extended review before patient notice is sent.
- Credit monitoring, identity theft protection, and credit freeze guidance have become routine remediation steps after these breaches.
- HIPAA reporting and state attorney general filings are recurring regulatory touchpoints, while some incidents also lead to class action litigation.
- A smaller set of current coverage adds system-level context, suggesting breach volume remains high even as faster detection and segmentation may reduce the number of affected individuals in some periods.
History
The story has broadened from a few notable healthcare intrusions into a wider pattern of repeated breaches across hospitals, medical groups, and outside vendors, with more emphasis on notification delays and formal compliance reporting. The new version also shifts the focus toward the recurring remediation playbook and the persistence of high breach volume.
The story broadens to include additional healthcare entities and shifts from isolated breach reports to a wider pattern of compromised accounts, data exfiltration, and extortion activity across healthcare vendors and providers. The updated version also adds more explicit emphasis on vendor-held data concentration and response measures while scope remains unresolved.
Featured
07-21-2026
Clover Health Investments disclosed a July 4 breach after a social engineering attack compromised three employee accounts accessing personal and protected health information in the U.S.
07-27-2026
MCBS reported a PEAR-attributed ransomware breach affecting 1,261,464 people in late September 2025, exposing Social Security numbers and medical information.
07-27-2026
Coca-Cola disclosed on July 16 that a ransomware attack on Fairlife led to a suspected data breach, following Anubis leak-site claims on July 20.
Timeline: 568 Days
Hover over any logo to see coverage summary, click for full article.
Additional Articles
⭐⭐⭐⭐⭐
Craneware disclosed an ongoing response to a cyberattack after hackers exfiltrated customer, employee, and partner data, with the investigation continuing in the United Kingdom.
Medical Computer Business Services reported a PEAR-attributed 2025 network breach impacting 1,261,464 people in Georgia, including exposure of health and identity data.
Medtronic notified more than 3.8 million patients after unauthorized access to corporate IT systems, and California released the breach notification letter on June 29.
Craneware disclosed an ongoing cyberattack and data exfiltration incident in the United Kingdom, impacting U.S. healthcare billing customers as investigation continues.
Clover Health disclosed a July 4 employee-account compromise in USA operations, potentially exposing member PII and protected health information while the company investigates scope.
Breach and vulnerability updates reported disclosure noncompliance, GitHub agentic exposure via prompt injection, and multiple major personal-data incidents affecting millions in the United States and United Kingdom.
AcademyHealth disclosed a ransomware-related data breach to the Vermont Attorney General on July 27, 2026 after a SafePay dark web claim in April 2026.
Texas received a breach filing on April 17, 2026, after ransomware group Payouts King claimed 435 GB of Eyemart Express data including PII and protected health information.
Western Orthopaedics disclosed a 2025 ransomware data breach affecting Texas and Massachusetts patients after PEAR claimed data access on the dark web.
NYC Health + Hospitals disclosed a data breach reported to U.S. HHS on March 24, 2026, affecting about 1.8 million people in New York City.
NLACRC detected suspected ransomware on Nov. 28, 2024 and later reported a Nov. 20-Dec. 1 data breach exposing PII and PHI to multiple state attorneys general.
Averhealth Holdings notified Vermont and Massachusetts residents after unauthorized access to Averest Inc email systems exposed Social Security numbers and health information in 2025-2026.
Heart Care Centers of Illinois reported a phishing-enabled employee email breach with exposure of sensitive PII and health information discovered in 2026.
Clover Health disclosed in a July 17 SEC filing that abnormal logins on July 4 led to social-engineering access of three employee health plan accounts.
Clover Health disclosed a July 4 social-engineering incident in a U.S. SEC filing after three employee accounts were compromised and PII and protected health information exposure occurred.
Medtronic notified more than 3.8 million people after ShinyHunters accessed corporate IT systems in April 2026 and stole personal and medical information.
Greenbaum Rowe Smith & Davis reported a healthcare data breach in New Jersey after compromised credentials exposed patient records in November 2025.
Bridewell and US HHS data show over 2,200 US medical center breaches since 2023, with fewer affected individuals in 2025 amid HIPAA segmentation and faster detection.
Eyemart Express reported an unauthorized access incident in February, with Feb. 12 exposure that may include Social Security numbers and health-plan data for some customers in the United States.
Radiology Associates of Richmond disclosed a 266,000-person breach after unauthorized acquisition of PHI and financial data around July 25, 2025, with notifications beginning May 21, 2026.
Clover Health disclosed a July 4 breach after unauthorized access to three employee accounts exposed potential personal and protected health information, pending scope investigation.
NAS Recovery Solutions in Lakewood, Colorado discovered May 13, 2026 that unauthorized workforce downloads exposed limited client identifiers, potentially revealing substance use disorder treatment under HIPAA.
Behavioral health providers in Colorado, Nebraska, Arizona, and Texas disclosed four data breaches involving unauthorized access and email compromises affecting patients and employees.
Heart Care Centers of Illinois notified affected Chicago-area individuals in July 2026 after unauthorized access to an employee email account from Aug 2024 to Nov 2024.
AdaptHealth disclosed on July 2 that social engineering enabled contractor-session compromise, leading to exfiltration of patient and insurance billing data from cloud systems.
Medtronic reported a ShinyHunters extortion attack discovered April 15, 2026, exposing personal and medical information for 3.8 million individuals.
Centers Lab NJ disclosed a HIPAA breach affecting 542,377 people after unauthorized system access between August 9 and 14, 2025.
Medtronic disclosed an April 2026 unauthorized access incident attributed to ShinyHunters that exposed personal and health information for 3.8 million people.
Medtronic notified 3,834,294 individuals in 2026 after ShinyHunters claimed unauthorized access to corporate IT systems and possible exposure of medical and identity data.
La Perouse notified the California Attorney General in 2025 of unauthorized access at a third-party billing platform affecting at least seven healthcare providers.
TrendAI analysis reports ransomware at 36.3% of healthcare-linked underground marketplace activity, using double extortion to steal and sell medical records.
In April 2026, Exitium ransomware claims targeted Gastroenterology & Hepatology of CNY in Syracuse, potentially exposing HIPAA medical records for over 167,000 patients.
Clover Health disclosed in an SEC filing on July 17 that social engineering enabled unauthorized access to three health plan employee accounts discovered on July 4.
Clover Health reported a July 4, 2026 unauthorized access incident after anomalous employee logins, with social engineering used to reach accounts handling member scheduling and sales data in the USA.
Lifespark Management Services detected suspicious email access in February 2026 and notified individuals in July 2026 of potential exposure of personal and health data.
On June 13, 2026, One Medical reported a June 8-11 vendor file-storage breach affecting archived former Iora Health Seniors patient data in multiple U.S. cities.
AdaptHealth reported a July 2, 2026 Form 8-K describing a June 15, 2026 threat actor claim and confirmed exfiltration of billing password data and possible PII/PHI from external EHR portals.
One Medical Seniors reported unauthorized access to third-party file storage of archived Iora Health patient files discovered June 13, with ShinyHunters extortion claims unverified.
Eyemart Express disclosed February 13 that unauthorized access the previous day may have exposed customers' sensitive personal data, including Social Security numbers.
In 2025, hospitals report email and vendor driven data breaches exposing protected health information across California, Louisiana, Connecticut, South Dakota, and Tennessee.
Two healthcare providers disclosed data breaches in 2025, exposing patient identifiers and health information, prompting breach notifications and identity protection measures.
HHS OCR reports 772 large healthcare breaches in 2025 under HITECH rules, while affected individuals fell versus 2024 due to Change Healthcare outlier impact.
HHS OCR breach-portal data under the HITECH Act reports 772 large US healthcare breaches in 2025, with hacking and mega-incidents shaping totals.
HHS OCR reported 772 large healthcare data breaches in 2025, exposing about 138.5 million records while OCR increased HIPAA Security Rule risk-analysis enforcement.
Sentara Hospitals in Virginia disclosed a reportable HIPAA violation after misrouted billing mail exposed protected health information without hacking, highlighting persistent physical-mail risk.
INC Ransom claimed mid-June 2026 ransomware access to Horizon Family Medical Group in Orange County, New York, with alleged protected health and financial data exposure.
In the US, healthcare data breaches expose identifiable medical information and are governed by HIPAA and the FTC Health Breach Notification Rule, shaping notice, mitigation, and legal recourse.
HHS Office for Civil Rights statistics show 2024 healthcare breaches exposed about 289 million people, largely due to a Change Healthcare ransomware attack.
In February 2024, ALPHV/BlackCat ransomware disrupted Change Healthcare systems and exposed Social Security numbers and medical records for about 192.7 million people in the United States.
Whitfield Regional Hospital detected unauthorized network access in 2025, later traced it to May 15, 2025, and issued patient notifications in July 2026.
Medtronic disclosed on April 24, 2026 an IT breach tied to ShinyHunters claims of stolen PII and internal data, with investigation and potential notifications under HIPAA and state breach laws.
⭐⭐⭐
Medtronic notified customers in 2026 after investigation found unauthorized access to corporate IT systems during April 13 to April 19, following ShinyHunters extortion claims.
Coca-Cola disclosed on July 16 that ransomware disrupted Fairlife production and enabled data theft, followed by an Anubis extortion leak after July 27.
Schubert Jonckheer & Kolbe LLP is investigating a Medtronic data breach after ShinyHunters claimed unauthorized access and Medtronic confirmed the incident in April 2026.
Radiology Associates of Richmond notified 266,000 patients after unauthorized access on or around July 25, 2025, exposing health and personal information.
Eyemart Express, LLC reported unauthorized access on February 12, 2026, and notified customers in the United States, including Social Security number exposure.
Radiology Associates of Richmond notified the Office of the Maine Attorney General on May 21 about unauthorized access to records of 266,183 patients.
Blue Fish Pediatrics notified 41,485 Texas residents after a July 2025 computer system breach potentially exposed Social Security numbers and health records, with mailed notices starting June 17, 2026.
Ransomware attacks and vendor breaches against healthcare providers in the USA and Germany increased in early 2026, leading to large-scale patient data theft and prolonged operational disruptions.
Longevity Health Plan reported a data breach affecting about 15,000 U.S. Medicare plan members after disclosure to HHS on March 4, 2026.
Aligned Orthopedic Partners reported an email system intrusion between Nov. 16 and Dec. 16, 2025, potentially exposing PII and protected health information.
Sandhills Medical Foundation disclosed on April 28, 2026 a ransomware breach that affected 169,017 patients after unauthorized access to company servers and potential exposure of personal health information.
Greater Boston Urology reported a protected health information breach affecting 4,717 people to the U.S. Department of Health and Human Services on Feb. 28, 2026.
Hematology Oncology Consultants reported a ransomware data breach targeting its Michigan network in 2025, exposing medical records and Social Security numbers, with notifications in 2026.
Belmont Aesthetic & Reconstructive Plastic Surgery disclosed a U.S. health-data breach impacting 528 individuals after an Insomnia ransomware dark-web claim on March 3, 2026.
FMRS Health Systems disclosed in 2026 an intrusion from January to February that potentially exposed PII and PHI, after Qilin claimed responsibility.
Lumio Dental disclosed a ransomware-linked breach to HHS on March 29, 2026, involving passport, driver license, and medical record extracts.
Vacation Myrtle Beach disclosed a ransomware-linked breach on June 16-19, 2025, potentially exposing Social Security numbers, financial data, and possible health records for about 10,750 people.
Medi-Rents & Sales Inc. disclosed an email data breach in early 2026 affecting 1,524 U.S. individuals, with potentially exposed insurance and limited health information.
NJ Pain Care Specialists LLC reported to U.S. HHS on May 14, 2026 after unauthorized access between Feb 25 and Feb 28, 2025 potentially exposed PII and protected health information.
Heart of America Eye Care disclosed a likely unauthorized network access event in Kansas City during April 2026, with HHS notification on June 5, 2026 after a CMD Organization dark web claim.
Mid-South Pulmonary & Sleep Specialists P.C. investigated ransomware-linked unauthorized network access in Memphis after Nov. 2, 2025 detection, later notifying patients in June 2026.
United HealthCare Services disclosed a health data breach affecting 34,574 U.S. individuals to HHS on June 5, 2026.
Erick K. Perroud, DDS disclosed a data breach affecting 7,692 individuals in the United States to the U.S. Department of Health and Human Services on June 10, 2026.
PennyMac unit Private National Mortgage Acceptance Company LLC disclosed a Group Health Plan breach affecting 3,972 U.S. individuals after HHS notification on June 9, 2026.
Easypak reported a ransomware-related data breach discovered in January 2026, with possible exposure of sensitive personal data for at least 217 Massachusetts residents.
Entyre Care Massachusetts Inc. disclosed a March 2026 data breach involving publicly accessible files containing Medicaid IDs and medical records, discovered on May 12, 2026.
Hudson Valley Medical Billing & Credentialing LLC reported possible unauthorized access in 2026, with Massachusetts notification and credit monitoring support beginning July 2026.
Madera Community Hospital reported an undisclosed-data network breach to the California Attorney General on July 14, 2026, after unauthorized third-party access in May 2025.
Clover Health disclosed a healthcare data breach to the SEC on July 4, 2026, with PII and PHI exposure in the United States.
Lifespark Management Services Inc. disclosed a 2026 email-environment data breach in St. Louis Park, Minnesota, after suspicious activity led to possible unauthorized access to PII and protected health information.
Wolf Haldenstein Adler Freeman & Herz LLP began investigating a Heart Care Centers of Illinois data breach in Palos Park, Illinois, after breach notifications.
Shamis & Gentile investigated a ransomware-linked breach at Tampa Bay Dental Implants & Periodontics in St. Petersburg, Florida, affecting 6,400 people via backed electronic medical records.
Clinical Registry disclosed a data breach affecting 8,545 patients at Dignity Health’s St. Mary’s Medical Center, including medical record identifiers.
Eyemart Express disclosed a February 2026 unauthorized-access cybersecurity event involving customer personal data and customer notification on July 24, 2026, from Texas.
Sandhills Medical Foundation discovered a May 2, 2025 ransomware incident on May 8, 2025, potentially exposing personal and medical data of 169,017 patients.
Casper Orthopedics disclosed a ransomware-linked data breach in the US after Anubis claimed responsibility for unauthorized exposure of patient medical records.
RXNT filed a Washington State Attorney General breach notification after possible unauthorized access to healthcare cloud systems holding personal and health-related data.
Craneware reported a cyberattack and stolen files from its data environment in the UK, with employee and selected customer and partner records exposed and investigation ongoing.
Medical Cost Benefit Services (MCBS) disclosed a data breach affecting about 1.2 million individuals, raising concerns about healthcare cybersecurity across integrated third-party ecosystems.
Radiology Associates of Richmond reported a healthcare data breach beginning around July 25, 2025, with PHI access discovered and investigated through April 6, 2026.
Craneware and Abbott investigated healthcare cyber incidents after alleged exfiltration through vendor systems and Abbott LabCentral portal access claims.
Lumio Dental reported an HHS Breach Portal submission on March 29 for a ransomware-linked breach affecting 500 people in Jenks, Oklahoma.
Anubis claimed credit in a Fairlife ransomware incident on the dark web while Coca-Cola reported unauthorized third-party access to production-related systems on July 16.
Open Arms Care Corporation notified clients in Tennessee starting June 9, 2026 after an internal review found unauthorized access to certain email accounts in 2025.
Lumexa notified Butte, Montana residents in June about a medical records breach that occurred March 31 to April 9 and affected at least 3,000 people.
Almeida Law Group investigates a June 8, 2026 alleged ransomware breach at Central Arkansas Pediatrics in Conway, Arkansas, while affected data scope remains unconfirmed.
Ransomware group Anubis claimed an attack on Casper Orthopedics in Wyoming on July 12, 2026, involving exposed patients data and medical records.
Alta Orthopaedics reported a March 2026 discovery of unauthorized access to patient data affecting systems during February 3-6, 2026, with remediation and credit monitoring offered.
Blue Fish Pediatrics in Houston, Texas disclosed a 2025 unauthorized access incident, later confirming exposed patient medical data and some Social Security numbers, with notifications starting June 17, 2026.
Select Medical began June 6, 2025 notifications after a July 2024 unauthorized third-party access to patient systems potentially exposed personal identifiers and protected health information.
Lumexa Imaging reported a vendor network incident on April 9, 2026, with unauthorized access between March 31 and April 9 potentially exposing patient records.
Radiology Associates of Richmond faced an alleged 2025 systems intrusion exposing patient PII and protected health information, with notifications mailed starting May 21, 2026, in Richmond, Virginia.
Xsolis disclosed a targeted phishing incident around January 22, 2026, involving potential unauthorized access to personal and protected health information, and offered identity monitoring via Kroll.
Unlimited Technology Systems LLC identified suspicious activity on October 19, 2025, after an unauthorized party potentially accessed patient PII and PHI in Montgomery, Ohio.
Federman & Sherwood is investigating NAS Recovery Solutions after a reported patient-data breach involving electronic medical records and network systems affected about 7,000 people in the USA.
Integrated Pain Associates reported a 2026 data breach in Killeen, Texas, exposing patient Social Security numbers and medical records and offering 12 months of credit monitoring.
Hokkaido's National Hospital Organization reported a hard-drive leak to police after a waste disposal vendor improperly destroyed drives containing hospital medical records.
Vital Imaging Diagnostic Centers reported a 2025 network intrusion in Miami involving unauthorized file removal that may have exposed medical and government identification data and issued notifications in 2026.
Heart Care Centers of Illinois notified individuals after a potential data breach on when and where Palos Park, Illinois exposed identity, payment, and medical information.
On April 24, 2026, Medtronic confirmed a corporate IT breach after ShinyHunters claimed terabytes of internal data exposure.
OCH Regional Medical Center filed an HHS Office for Civil Rights breach notice on March 11, 2025 and began notifying affected individuals after unauthorized access to sensitive consumer information.
Health data breaches at CPAP Medical Services, Health Services LLC, and East Adams Rural Healthcare affect patients in Florida, Maine, and Washington during 2024 and 2025.
Frederick Health Medical Group confirmed a ransomware breach affecting 934,326 patients in Maryland in 2025, triggering class action lawsuits alleging cybersecurity and breach-notice failures.
Healthcare providers in the United States reported 2024 to 2025 data breaches, with investigations finding unauthorized access to patient identifiers and medical information.
UChicago Medicine disclosed a July 2024 third-party vendor cybersecurity incident through Nationwide Recovery Services that may have exposed personal data of nearly 40,000 patients.
Altos disclosed on June 17 that an unauthorized party accessed an internet exposed internal system containing personal and health data of patients in Southern California.
Goshen Medical Center in Fayetteville disclosed a ransomware driven data breach affecting 456385 patients on March 4 2025
Hackers breached Healthcare Interactive between July 8 and July 12, 2025, exposing customer personal and health data in the United States.
Healthcare breaches involving unsecured PHI trigger HIPAA notification duties to individuals and HHS, with ransomware, phishing, and cloud misconfiguration cited as common causes.
Novo Nordisk is linked to a reported cyberattack targeting clinical trial and AI research data, while 2025 healthcare breach reporting indicates large-scale credential-driven exposures.
IPPC reported an unauthorized network access in September 2025 that potentially exposed PHI and PII for over 133,000 customers across six states.
Richmond University Medical Center reported a healthcare data breach in New York involving accessed or removed files around May 6, 2023, with potential exposure of protected health information for 674,000 people.
Springfield Hospital notified individuals starting February 10, 2026, after a December 17, 2025 employee email account compromise potentially exposed personal and health information.
Ransomware intelligence on July 2, 2026 alleged an unverified INCRansom attack on Colorado Rehabilitation & Occupational Medicine, with patient data exposure unconfirmed.
DermCare Management notified affected individuals in March 2026 after a February 2025 unauthorized access event potentially impacted patient information.
Spokane Digestive Disease Center disclosed May 2026 findings of unauthorized employee email access that exposed patient data, with notifications beginning May 26.
McLeod Health detected unauthorized access to a Dillon Family Medicine server months after Oct 2025 intrusions, with Qilin ransomware blamed and HIPAA timing issues discussed.
Qilin claimed a mid-May 2026 ransomware attack on Spirit Medical Transport, potentially exposing protected health information for patients in Western Ohio and Eastern Indiana.
Sterling Seacrest Pritchard notified people about possible unauthorized access to email-environment data between August 12 and 13, 2025, with notifications through April 2026.
DermCare Management found suspicious activity on February 26, 2025 and reported an intrusion between February 14 and February 26 that may have exposed patient PII and PHI.
⭐️⭐️
Hackers accessed CPAP Medical Supplies and Services systems in December 2024, exposing personal and health information for more than 90,000 individuals in the United States.
Medical Associates of Brevard in Melbourne, Florida, disclosed a January 2025 data breach affecting about 246,711 individuals.
February 13 2025 breach at Vital Imaging affected 260000 patients in Florida, with investigators probing medical and demographic data exposure.
Delta Medical Systems detected a data breach on July 15 2025 in Wisconsin and notified affected individuals by February 11 2026.