Healthcare data breaches expose some of the most sensitive personal information that exists: medical records, Social Security numbers, insurance details, diagnosis and treatment history, and sometimes genetic or mental health information. These exposures can lead to medical identity theft, insurance fraud committed in a patient’s name, and the unwanted disclosure of private health conditions that can affect employment, relationships, or insurability. Hospitals, clinics, health insurers, and healthcare technology vendors are among the most frequently targeted organizations for ransomware and data theft, in part because medical records are especially valuable on illicit markets and healthcare providers often operate complex, interconnected IT systems. A single breach at a hospital system, health plan, or medical billing vendor can affect hundreds of thousands of patients at once. This page tracks confirmed data breaches at hospitals, clinics, insurers, and other healthcare organizations, including what data was exposed, which companies notified the HHS Office for Civil Rights and other regulators, and what affected patients can do next to protect their medical and financial identity.
Lifespan Physicians Group of Massachusetts, Inc., doing business as Brown Health Medical Group-MA, notified regulators that a data breach exposed patients’ Social Security numbers, financial account details, and health records.
Grafton City Hospital, Inc. notified federal regulators that a hacking incident involving an employee email account exposed personal and health information belonging to 1,215 patients.
Grafton City Hospital, Inc. Data Breach Exposes Patient Health and Personal Information Read More »
On Demand Occupational Medicine, an Ohio-based occupational health provider, suffered a ransomware attack claimed by the Wallstreet threat group, raising concerns that patient and employee health records were exposed.
Heywood Healthcare Inc. and its affiliated hospitals notified Vermont regulators of a data breach that exposed patients’ Social Security numbers, government ID numbers, and health records.
Heywood Healthcare Inc. Data Breach Exposes Social Security Numbers and Health Records Read More »
A ransomware group known as Chaos has claimed responsibility for a cyberattack on Mankato Clinic, raising concerns that patient health and personal data may have been accessed or stolen.
Mankato Clinic Data Breach Exposes Patient Health and Personal Information Read More »
White River Junction VA Medical Center notified federal regulators that unauthorized access to email exposed protected health information belonging to 1,408 patients.
White River Junction VA Medical Center Data Breach Exposes Patient Health Information Read More »
Shenandoah Valley Medical System, Inc. notified regulators that a data breach exposed patients’ Social Security numbers, raising serious identity theft risks for those affected.
Shenandoah Valley Medical System, Inc. Data Breach Exposes Social Security Numbers Read More »
LHC Group, Inc. notified regulators of a data breach that may have exposed patients’ and employees’ personal and health information, prompting new identity theft concerns.
LHC Group, Inc. Data Breach Exposes Personal and Health Information Read More »
Desert Pulmonary & Sleep Consultants, P.L.C. notified federal regulators that unauthorized access to its network and electronic medical records exposed sensitive patient information for 3,000 individuals.
Desert Pulmonary & Sleep Consultants Data Breach Exposes Electronic Medical Records Read More »
Shoshone Medical Center notified federal regulators that a hacking incident involving its email system exposed the personal and health information of 553 individuals.
Shoshone Medical Center Data Breach Exposes Patient Health Information Read More »