Healthcare data breaches expose some of the most sensitive personal information that exists: medical records, Social Security numbers, insurance details, diagnosis and treatment history, and sometimes genetic or mental health information. These exposures can lead to medical identity theft, insurance fraud committed in a patient’s name, and the unwanted disclosure of private health conditions that can affect employment, relationships, or insurability. Hospitals, clinics, health insurers, and healthcare technology vendors are among the most frequently targeted organizations for ransomware and data theft, in part because medical records are especially valuable on illicit markets and healthcare providers often operate complex, interconnected IT systems. A single breach at a hospital system, health plan, or medical billing vendor can affect hundreds of thousands of patients at once. This page tracks confirmed data breaches at hospitals, clinics, insurers, and other healthcare organizations, including what data was exposed, which companies notified the HHS Office for Civil Rights and other regulators, and what affected patients can do next to protect their medical and financial identity.
An unauthorized actor accessed MediCopy’s cloud-based file sharing platform in January 2026, exposing Social Security numbers, medical records and other sensitive data belonging to patients of Deaconess Health System.
MediCopy Data Breach Exposes Social Security Numbers and Medical Records Read More »
Manhattan Retirement Foundation, doing business as Meadowlark Hills, confirmed a data breach that exposed Social Security numbers, health records and financial data belonging to 14,442 people nationwide.
Trinity Health has notified nearly 6,000 patients that their health information may have been improperly disclosed through a health information exchange partner, exposing medical records and other sensitive data.
Trinity Health Data Breach Exposes Medical Records and Driver License Numbers Read More »
Hematology Oncology Consultants, a Michigan cancer and blood disorder practice, has notified patients that a ransomware attack by the Rhysida group exposed names, Social Security numbers, medical records and health insurance information.
Georgia Vascular Specialists PC disclosed a data breach involving protected health information to federal regulators, raising concerns for patients about exposed medical records and insurance details.
Hims & Hers has notified customers that unauthorized access to its third-party customer service platform exposed names, contact information, and medical information tied to support tickets.
Hims & Hers Data Breach Exposes Names, Contact Details and Medical Information Read More »
Windward Life Care, a San Diego home care provider, confirmed a data breach after a ransomware group claimed it stole 25 gigabytes of sensitive customer and patient data.
Windward Life Care Data Breach Exposes Social Security Numbers and Medical Records Read More »
Ikron Corporation, an Ohio and Washington nonprofit providing behavioral health and vocational services, disclosed a ransomware attack that exposed Social Security numbers, health records and employment data for nearly 12,000 people.
Ikron Corporation Data Breach Exposes Social Security Numbers and Health Records Read More »
Modern Health, a mental health platform, disclosed a data breach involving unauthorized access to member profiles by someone within its provider network, exposing protected health information.
Modern Health Data Breach Exposes Protected Health Information Read More »
NYC Health + Hospitals disclosed a data breach affecting roughly 1.8 million people, exposing Social Security numbers, medical records, biometric data and financial account information.
NYC Health + Hospitals Data Breach Exposes Social Security Numbers and Medical Records Read More »