Healthcare data breaches expose some of the most sensitive personal information that exists: medical records, Social Security numbers, insurance details, diagnosis and treatment history, and sometimes genetic or mental health information. These exposures can lead to medical identity theft, insurance fraud committed in a patient’s name, and the unwanted disclosure of private health conditions that can affect employment, relationships, or insurability. Hospitals, clinics, health insurers, and healthcare technology vendors are among the most frequently targeted organizations for ransomware and data theft, in part because medical records are especially valuable on illicit markets and healthcare providers often operate complex, interconnected IT systems. A single breach at a hospital system, health plan, or medical billing vendor can affect hundreds of thousands of patients at once. This page tracks confirmed data breaches at hospitals, clinics, insurers, and other healthcare organizations, including what data was exposed, which companies notified the HHS Office for Civil Rights and other regulators, and what affected patients can do next to protect their medical and financial identity.
A ransomware attack by the Qilin group on Mid Michigan Medical Billing Service exposed Social Security numbers, medical records, and financial data belonging to 28,185 individuals nationwide.
Imperial Beach Community Clinic in San Diego notified patients that an email system intrusion led to unauthorized access and possible copying of sensitive medical information over several months in 2025.
Imperial Beach Community Clinic Data Breach Exposes Patient Medical Information Read More »
An optometry practice operating as Vision Care 4Life in Wichita, Kansas, reported a data breach affecting at least 20,000 patients, exposing names, medical records, and insurance information.
Wendy Foster OD Data Breach Exposes Medical Records and Insurance Information Read More »
A third-party vendor breach at Elara Caring exposed the names, Social Security numbers, medical records and health insurance information of over 10,000 patients nationwide.
Elara Caring Data Breach Exposes Social Security Numbers and Medical Records Read More »
A ransomware attack by the Qilin group on Columbia Medical Practice exposed patients’ Social Security numbers, health records and financial account information after files were stolen from the network.
Coastal Carolina Centers of Urology and Surgery disclosed a data breach that exposed patient health records, notifying the Vermont Attorney General in May 2026.
Coastal Carolina Urology Data Breach Exposes Patient Health Records Read More »
A cyberattack on Central Ozarks Medical Center exposed the personal and medical information of nearly 12,000 patients, including Social Security numbers and health insurance details.
An unauthorized actor accessed an employee email account at Bridle Trails Family Dentistry, exposing Social Security numbers, driver’s license numbers, and health information for nearly 21,000 people.
A hacking incident reported to federal regulators lists The Lutheran Home for the Aged in Missouri as having potentially exposed personal data belonging to 2,311 individuals.
The Lutheran Home Data Breach Exposes Sensitive Personal Information Read More »
Signature Healthcare Corp., a Massachusetts nonprofit health system, disclosed a data breach to federal regulators that may have compromised patient information across the United States.
Signature Healthcare Data Breach Compromises Patient Information Read More »