Healthcare data breaches expose some of the most sensitive personal information that exists: medical records, Social Security numbers, insurance details, diagnosis and treatment history, and sometimes genetic or mental health information. These exposures can lead to medical identity theft, insurance fraud committed in a patient’s name, and the unwanted disclosure of private health conditions that can affect employment, relationships, or insurability. Hospitals, clinics, health insurers, and healthcare technology vendors are among the most frequently targeted organizations for ransomware and data theft, in part because medical records are especially valuable on illicit markets and healthcare providers often operate complex, interconnected IT systems. A single breach at a hospital system, health plan, or medical billing vendor can affect hundreds of thousands of patients at once. This page tracks confirmed data breaches at hospitals, clinics, insurers, and other healthcare organizations, including what data was exposed, which companies notified the HHS Office for Civil Rights and other regulators, and what affected patients can do next to protect their medical and financial identity.
A ransomware attack on North Los Angeles County Regional Center exposed Social Security numbers, financial data and detailed medical records belonging to nearly 300,000 people nationwide.
NLACRC Data Breach Exposes Social Security Numbers and Medical Records Read More »
Optalis Management Solutions, an Ohio-based healthcare organization, has notified individuals that a network intrusion in April 2025 may have exposed Social Security numbers, financial information, and medical records.
Serviceaide, a vendor for Catholic Health, agreed to pay $1.8 million to settle lawsuits over a 2024 data breach that exposed the personal and medical data of roughly 483,000 patients.
Serviceaide Data Breach Exposes Social Security Numbers and Medical Records Read More »
Greater Rochester Independent Practice Association has agreed to a $2.15 million settlement after the 2023 MOVEit data breach exposed patients’ Social Security numbers, health records, and prescription information.
Phoenix Environmental Laboratories, a Connecticut laboratory company, appeared on Vermont’s official breach notice list after names, Social Security numbers, and medical record numbers were reportedly involved in a security incident.
Glucobit Inc., doing business as Reframe, reported a hacking incident that exposed the names and health records of 43,902 people, according to a state attorney general filing.
Reframe Data Breach Exposes Names and Health Records Read More »
AdaptHealth Corp, a Pennsylvania healthcare company, disclosed a hacking incident that may have exposed patient names, health records, and health insurance information.
AdaptHealth Data Breach Exposes Names, Health Records, and Insurance Information Read More »
A ransomware attack on the Texas Hearing Institute exposed the names, Social Security numbers, financial information, and medical records of nearly 30,000 Texas residents.
Texas Hearing Institute Data Breach Exposes Social Security Numbers and Medical Records Read More »
Members of the Scattered Spider hacking group pleaded guilty to conspiracy charges tied to cyberattacks on U.S. healthcare providers SSM Health Care and Sutter Health, raising fresh concerns about patient data security.
SSM Health Care and Sutter Health Data Breach Exposes Patient Records Read More »
Virta Health discovered that an unauthorized party accessed a data repository containing historical patient records over a three-day period in March 2026, exposing names, Social Security or ITIN numbers, birth dates, contact details, and extensive medical and insurance information. Anyone notified by Virta Health should immediately enroll in the free credit monitoring offered and closely
Virta Health Data Breach 2026: Sensitive Medical and Personal Information Exposed Read More »