Healthcare data breaches expose some of the most sensitive personal information that exists: medical records, Social Security numbers, insurance details, diagnosis and treatment history, and sometimes genetic or mental health information. These exposures can lead to medical identity theft, insurance fraud committed in a patient’s name, and the unwanted disclosure of private health conditions that can affect employment, relationships, or insurability. Hospitals, clinics, health insurers, and healthcare technology vendors are among the most frequently targeted organizations for ransomware and data theft, in part because medical records are especially valuable on illicit markets and healthcare providers often operate complex, interconnected IT systems. A single breach at a hospital system, health plan, or medical billing vendor can affect hundreds of thousands of patients at once. This page tracks confirmed data breaches at hospitals, clinics, insurers, and other healthcare organizations, including what data was exposed, which companies notified the HHS Office for Civil Rights and other regulators, and what affected patients can do next to protect their medical and financial identity.
A vendor breach at Aesto Health exposed sensitive patient records belonging to OB-GYN South, an Alabama women’s health provider, including Social Security numbers and medical information.
OB-GYN South Data Breach Exposes Social Security Numbers and Medical Records Read More »
Eastside Gynecology & Obstetrics notified patients that a security incident at its records vendor, Aesto Health, exposed names, Social Security numbers, medical information, and other sensitive data.
Henry County Hospital notified patients that a security incident at its third-party vendor Aesto Health exposed names, medical information, driver’s license numbers, financial account numbers, and Social Security numbers.
Henry County Hospital Data Breach Exposes Social Security Numbers and Medical Records Read More »
Health Payment Systems, Inc., the Wisconsin company behind the PayMedix payment platform, reported an email hacking incident to federal regulators that may have affected roughly 9,380 individuals.
Health Payment Systems Data Breach Exposes Health Payment and Billing Records Read More »
A Florida healthcare provider, Claremedica Viking, LLC, notified federal regulators of an email hacking incident that may have exposed the personal and health information of roughly 675 patients.
Claremedica Viking, LLC Data Breach Exposes Patient Health Information Read More »
Alpine Agency of the Midlands, LLC notified federal regulators of a hacking incident that compromised email accounts containing personal health information for 500 individuals.
Alpine Agency of the Midlands Data Breach Exposes Personal Health Information Read More »
A North Carolina primary care practice, Family Medical Associates of Raleigh, PA, reported a network server hacking incident to federal regulators that may have exposed health information belonging to roughly 500 patients.
Family Medical Associates of Raleigh, PA Data Breach Exposes Patient Health Records Read More »
Madera Community Hospital notified federal regulators that a hacking incident on its network server compromised the personal and health information of 150,810 individuals.
Madera Community Hospital Data Breach Exposes Patient Health Records Read More »
A network intrusion at a third-party records vendor exposed personal and health information belonging to patients of Stanislaus County Health Services Agency, prompting notification letters months after the incident occurred.
Stanislaus County Health Services Agency Data Breach Exposes Patient Health Information Read More »
Everside Health has notified patients that a network intrusion at third-party vendor Aesto, LLC exposed names, Social Security numbers, medical information and other sensitive data.
Everside Health Data Breach Exposes Social Security Numbers and Medical Records Read More »