Healthcare data breaches expose some of the most sensitive personal information that exists: medical records, Social Security numbers, insurance details, diagnosis and treatment history, and sometimes genetic or mental health information. These exposures can lead to medical identity theft, insurance fraud committed in a patient’s name, and the unwanted disclosure of private health conditions that can affect employment, relationships, or insurability. Hospitals, clinics, health insurers, and healthcare technology vendors are among the most frequently targeted organizations for ransomware and data theft, in part because medical records are especially valuable on illicit markets and healthcare providers often operate complex, interconnected IT systems. A single breach at a hospital system, health plan, or medical billing vendor can affect hundreds of thousands of patients at once. This page tracks confirmed data breaches at hospitals, clinics, insurers, and other healthcare organizations, including what data was exposed, which companies notified the HHS Office for Civil Rights and other regulators, and what affected patients can do next to protect their medical and financial identity.
A ransomware group claims to have stolen more than 28 gigabytes of files from Middendorf Animal Hospital & Laser Centre in Kentucky, raising concerns about exposed client and employee data.
Middendorf Animal Hospital Data Breach Exposes Client and Employee Records Read More »
Spokane Digestive Disease Center, P.S. notified Washington regulators of a data breach that may have compromised sensitive patient health information.
Spokane Digestive Disease Center Data Breach Exposes Patient Health Records Read More »
Networking Technology, Inc. (RXNT), a healthcare software provider, notified the Washington State Attorney General of a data breach affecting patient information stored on its systems.
RXNT Data Breach Exposes Patient Health and Personal Information Read More »
WellPoint, tied to Independent Clinics of Washington and Elevance Health, filed a data breach notification with the Washington State Attorney General after discovering unauthorized access to sensitive patient information.
WellPoint Data Breach Exposes Medical Records and Personal Health Information Read More »
HP Dental, a New York healthcare provider, notified federal regulators that a hacking incident involving its email systems exposed personal and health information belonging to 548 patients.
HP Dental Data Breach Exposes Patient Health and Personal Information Read More »
A data security incident at Sabine County Hospital in Hemphill, Texas exposed the names, Social Security numbers, financial accounts, and medical records of roughly 7,750 patients.
Sabine County Hospital Data Breach Exposes Social Security Numbers and Medical Records Read More »
Dermatology Partners notified patients of its Catonsville, Maryland office that an unauthorized individual accessed its data system for nearly two weeks, potentially exposing medical records and personal details.
Dermatology Partners Data Breach Exposes Patient Medical Records Read More »
Advocate Warriors LLC, a Boise counseling and care coordination provider, disclosed to federal regulators that a hacking incident involving email accounts affected roughly 750 clients.
Advocate Warriors Data Breach Exposes Client Personal and Health Information Read More »
Saint Pete MRI has notified patients that a network intrusion detected in February 2025 may have exposed Social Security numbers, medical records, and other sensitive data. Notification letters went out in July 2026, more than a year after the incident was first detected.
Saint Pete MRI Data Breach Exposes Social Security Numbers and Medical Records Read More »
Any-Time Home Care, Inc. told regulators that unauthorized access to its systems may have exposed clients’ Social Security numbers and health records, prompting concerns about identity theft and medical fraud.
Any-Time Home Care, Inc. Data Breach Exposes Social Security Numbers and Health Records Read More »