Healthcare data breaches expose some of the most sensitive personal information that exists: medical records, Social Security numbers, insurance details, diagnosis and treatment history, and sometimes genetic or mental health information. These exposures can lead to medical identity theft, insurance fraud committed in a patient’s name, and the unwanted disclosure of private health conditions that can affect employment, relationships, or insurability. Hospitals, clinics, health insurers, and healthcare technology vendors are among the most frequently targeted organizations for ransomware and data theft, in part because medical records are especially valuable on illicit markets and healthcare providers often operate complex, interconnected IT systems. A single breach at a hospital system, health plan, or medical billing vendor can affect hundreds of thousands of patients at once. This page tracks confirmed data breaches at hospitals, clinics, insurers, and other healthcare organizations, including what data was exposed, which companies notified the HHS Office for Civil Rights and other regulators, and what affected patients can do next to protect their medical and financial identity.
A vendor’s exposed access key led to the Denver Health Medical Plan data breach, affecting more than 238,000 current and former plan members.
Denver Health Medical Plan Data Breach Exposes Health and Demographic Information Read More »
CallonDoc, Inc. notified the Washington State Attorney General of a data breach that may have exposed personal information belonging to patients or customers.
CallonDoc, Inc. Data Breach Exposes Personal Information Read More »
Brooklyn Counseling Services notified Vermont regulators that a data breach exposed health records belonging to clients. Here is what is known so far and what affected individuals should do next.
Brooklyn Counseling Services Data Breach Exposes Health Records Read More »
Northeastern Mental Health Center notified the Vermont Attorney General that a data breach exposed patients’ Social Security numbers and health records.
Quest Diagnostics confirmed that a threat actor gained unauthorized access to its Quanum LSM platform, exposing patient records used by physicians and medical offices.
Quest Diagnostics Incorporated Data Breach Exposes Patient Records Read More »
A ransomware group claims it accessed customer and internal files in a reported Newcomer Cremations, Funerals & Receptions data breach, though the company has not confirmed the incident.
An extortion group claims to have stolen patient and staff data from Andrews Advisory Group LLC, though the company has not confirmed the incident publicly.
An extortion group claims it stole patient lab and billing files from Arthritis Center of Riverside, a rheumatology practice in California. The practice has not publicly confirmed the incident.
EyeMed Vision Care, LLC notified Vermont regulators that a data breach exposed customers’ Social Security numbers, raising identity theft risks for those affected.
EyeMed Vision Care, LLC Data Breach Exposes Social Security Numbers Read More »
A ransomware group has claimed responsibility for an attack on Prism Medical Products, alleging access to company data. The claim has not been confirmed by the company.
Prism Medical Products Data Breach Claim: Personal Information Reportedly Exposed Read More »