Healthcare data breaches expose some of the most sensitive personal information that exists: medical records, Social Security numbers, insurance details, diagnosis and treatment history, and sometimes genetic or mental health information. These exposures can lead to medical identity theft, insurance fraud committed in a patient’s name, and the unwanted disclosure of private health conditions that can affect employment, relationships, or insurability. Hospitals, clinics, health insurers, and healthcare technology vendors are among the most frequently targeted organizations for ransomware and data theft, in part because medical records are especially valuable on illicit markets and healthcare providers often operate complex, interconnected IT systems. A single breach at a hospital system, health plan, or medical billing vendor can affect hundreds of thousands of patients at once. This page tracks confirmed data breaches at hospitals, clinics, insurers, and other healthcare organizations, including what data was exposed, which companies notified the HHS Office for Civil Rights and other regulators, and what affected patients can do next to protect their medical and financial identity.
A hacker group known as Global Secret Group claims it stole roughly 646 gigabytes of data from Pavillon, a North Carolina addiction treatment center, though the organization has not yet confirmed the incident.
Pavillon Data Breach Exposes Patient Treatment and Personal Records Read More »
Heart of America Medical Center in Rugby, North Dakota, has notified patients that a 2025 network intrusion may have exposed their personal and medical information, with letters going out more than a year later in 2026.
Heart of America Medical Center Data Breach Exposes Patient Medical and SSN Data Read More »
Mon Health, a West Virginia healthcare provider, disclosed a phishing attack on employee email accounts that may have exposed patient Social Security numbers, health records, and insurance details.
Mon Health Data Breach Exposes Social Security Numbers and Health Records Read More »
UCLA Health notified patients that their protected health information was improperly shared with an outside provider, exposing names, health insurance details, and clinical records.
UCLA Health Data Breach Exposes Patient Health and Personal Information Read More »
Healthcare Highways, a Texas-based medical network company, is investigating claims by the hacker group Chaos that it stole roughly 235 gigabytes of company and client records.
Healthcare Highways Data Breach Exposes Company and Client Records Read More »
HCA Healthcare has notified employees that a phishing attack on its HR portal let attackers steal login credentials, redirect payroll deposits, and access Social Security numbers and bank account details.
HCA Healthcare Data Breach Exposes Social Security Numbers and Bank Details Read More »
Village Practice Management Company, LLC, operating as VillageMD, notified regulators that a security incident exposed the names, Social Security numbers, medical information, and dates of birth of more than 25,000 individuals.
VillageMD Data Breach Exposes Social Security Numbers and Medical Records Read More »
Brown Health Medical Group-MA has confirmed that a December 2025 security incident exposed the personal and health information of nearly 312,000 patients and employees.
Open Door Health Center of Illinois notified federal regulators that a network server hacking incident compromised the protected health information of 501 patients.
Open Door Health Center of Illinois Data Breach Exposes Patient Health Records Read More »
A coalition of 42 state attorneys general reached a bankruptcy settlement with 23andMe over a 2023 data breach that exposed genetic and personal data of 6.9 million customers worldwide.
23andMe Data Breach Exposes Genetic Ancestry Data and Personal Information Read More »