Healthcare data breaches expose some of the most sensitive personal information that exists: medical records, Social Security numbers, insurance details, diagnosis and treatment history, and sometimes genetic or mental health information. These exposures can lead to medical identity theft, insurance fraud committed in a patient’s name, and the unwanted disclosure of private health conditions that can affect employment, relationships, or insurability. Hospitals, clinics, health insurers, and healthcare technology vendors are among the most frequently targeted organizations for ransomware and data theft, in part because medical records are especially valuable on illicit markets and healthcare providers often operate complex, interconnected IT systems. A single breach at a hospital system, health plan, or medical billing vendor can affect hundreds of thousands of patients at once. This page tracks confirmed data breaches at hospitals, clinics, insurers, and other healthcare organizations, including what data was exposed, which companies notified the HHS Office for Civil Rights and other regulators, and what affected patients can do next to protect their medical and financial identity.
A Rhode Island cardiology practice notified patients that unauthorized access to its email systems exposed names, medical records, and financial account details months after the intrusion occurred.
A Michigan senior living community began notifying residents in June 2026 that hackers accessed sensitive personal, financial, and medical information during a January 2026 intrusion.
Maximus, a government services contractor, disclosed that hackers may have accessed names, birth dates, and Social Security numbers tied to Nebraska’s Medicaid provider system.
Maximus Data Breach Exposes Social Security Numbers and Personal Data Read More »
HHS OCR has reached a settlement with OSF Healthcare System stemming from a 2021 ransomware attack that exposed patient health and personal information, closing out a long-running federal investigation into the incident.
OSF Healthcare Data Breach Exposes Patient Health and Personal Information Read More »
A vishing attack on a Quantum Health employee led to unauthorized access of client files containing Social Security numbers, health insurance details, and medical information.
Quantum Health Data Breach Exposes Social Security Numbers and Health Records Read More »
1Life Healthcare, Inc., the parent company of One Medical and Iora Health, notified Washington state regulators of a data breach that may have exposed patient personal and health information.
1Life Healthcare Data Breach Exposes Patient Health and Personal Information Read More »
An unauthorized party accessed an employee email account at Youth Home, a Little Rock mental health treatment provider, exposing clients’ Social Security numbers, diagnoses, and other sensitive treatment records.
Youth Home Data Breach Exposes Social Security Numbers and Medical Records Read More »
A document disposal error at the Regional Center of Orange County’s Cypress office exposed the personal and health information of individuals served through the program.
Regional Center of Orange County Data Breach Exposes Personal Health Information Read More »
Loma Linda University Health notified patients after a file with medical record numbers and orthopedic care details was mistakenly uploaded to an outside AI platform during a research study.
Loma Linda University Health Data Breach Exposes Medical Record Numbers Read More »
A social engineering scam tricked a Sunshine Health employee into handing over member health plan files, exposing medical and personal data for 41,569 people.
Sunshine Health Data Breach Exposes Medical Records and Health Plan Data Read More »