Healthcare data breaches expose some of the most sensitive personal information that exists: medical records, Social Security numbers, insurance details, diagnosis and treatment history, and sometimes genetic or mental health information. These exposures can lead to medical identity theft, insurance fraud committed in a patient’s name, and the unwanted disclosure of private health conditions that can affect employment, relationships, or insurability. Hospitals, clinics, health insurers, and healthcare technology vendors are among the most frequently targeted organizations for ransomware and data theft, in part because medical records are especially valuable on illicit markets and healthcare providers often operate complex, interconnected IT systems. A single breach at a hospital system, health plan, or medical billing vendor can affect hundreds of thousands of patients at once. This page tracks confirmed data breaches at hospitals, clinics, insurers, and other healthcare organizations, including what data was exposed, which companies notified the HHS Office for Civil Rights and other regulators, and what affected patients can do next to protect their medical and financial identity.
Erlanger Health, a Tennessee healthcare provider, notified federal regulators that unauthorized access to its electronic medical records exposed personal and health information belonging to 4,237 individuals.
Erlanger Health Data Breach Exposes Patient Medical Records and Personal Information Read More »
Lucent Health Solutions has agreed to pay up to $1.95 million to settle a class action lawsuit over a 2023 phishing attack that exposed the Social Security numbers and health information of roughly 37,000 people.
Lucent Health Solutions Data Breach Exposes Social Security Numbers and Health Records Read More »
TriWest Healthcare Alliance notified California regulators of a data breach that may have exposed sensitive personal and health information belonging to affected individuals.
TriWest Healthcare Alliance Data Breach Exposes Personal and Health Information Read More »
Alta Orthopaedics Medical Group, Inc. notified California regulators of a data breach that may have exposed patients’ medical and personal information. Here’s what patients need to know.
Alta Orthopaedics Medical Group Data Breach Exposes Patient Medical Records Read More »
BrightSpring Health Services notified Delaware regulators and affected individuals after unauthorized access exposed personal and medical information, prompting concerns over identity theft and medical fraud.
Marlboro-Chesterfield Pathology has settled a class action lawsuit after a 2025 ransomware attack exposed the Social Security numbers and health information of nearly 236,000 people.
Navvis & Company, LLC notified the Delaware Attorney General of a data breach that may have exposed sensitive personal and health information belonging to affected individuals.
Navvis & Company Data Breach Exposes Personal and Health Information Read More »
Ascension Health filed a supplemental data breach notification with the Delaware Attorney General, confirming that patient medical, financial, and personal information was compromised in a cyberattack.
Ascension Health Data Breach Exposes Patient Medical and Financial Information Read More »
MedRevenu, a California revenue cycle management firm, confirmed a ransomware attack exposed patient Social Security numbers, health records, and financial information after the BianLian group claimed responsibility.
MedRevenu Data Breach Exposes Social Security Numbers and Medical Records Read More »
The Devereux Foundation, a national behavioral healthcare nonprofit, confirmed a data breach after a ransomware group claimed to have stolen sensitive clinical, financial and personal information belonging to clients, employees, donors and partners.
The Devereux Foundation Data Breach Exposes Clinical and Financial Information Read More »