Healthcare data breaches expose some of the most sensitive personal information that exists: medical records, Social Security numbers, insurance details, diagnosis and treatment history, and sometimes genetic or mental health information. These exposures can lead to medical identity theft, insurance fraud committed in a patient’s name, and the unwanted disclosure of private health conditions that can affect employment, relationships, or insurability. Hospitals, clinics, health insurers, and healthcare technology vendors are among the most frequently targeted organizations for ransomware and data theft, in part because medical records are especially valuable on illicit markets and healthcare providers often operate complex, interconnected IT systems. A single breach at a hospital system, health plan, or medical billing vendor can affect hundreds of thousands of patients at once. This page tracks confirmed data breaches at hospitals, clinics, insurers, and other healthcare organizations, including what data was exposed, which companies notified the HHS Office for Civil Rights and other regulators, and what affected patients can do next to protect their medical and financial identity.
A Nashville pathology provider, Anatomic and Clinical Laboratory Associates, P.C., says an unauthorized actor accessed and downloaded patient files containing Social Security numbers and detailed medical records.
NAS Recovery Solutions, a Colorado behavioral health provider, says workforce members may have improperly downloaded client records, exposing contact details for about 7,000 people.
NAS Recovery Solutions Data Breach Exposes Client Names and Contact Details Read More »
Healthcare Services Group has agreed to pay $3 million to resolve lawsuits over a 2024 data breach that exposed the personal and health information of more than 624,000 individuals.
Healthcare Services Group Data Breach Exposes Social Security Numbers and Health Records Read More »
Penobscot Valley Hospital in Maine has notified patients and employees that hackers may have accessed their names, Social Security numbers, medical information, and financial data after a network intrusion detected in January 2026.
Xsolis, a healthcare case management vendor, discovered a phishing attack that gave attackers unauthorized access to a portion of its systems, potentially exposing patients’ protected health information.
Xsolis Data Breach Exposes Protected Health Information Read More »
Marin Cancer Care has notified patients that hackers accessed its network and copied files containing personal and health information late in 2025.
Marin Cancer Care Data Breach Exposes Patient Health and Personal Information Read More »
ApolloMD Business Services has agreed to a $4.02 million settlement after a 2025 ransomware attack exposed the health and personal data of over 626,000 patients. Affected individuals can now file claims for cash payments or reimbursement.
ApolloMD Data Breach Exposes Social Security Numbers and Health Records Read More »
Sanger Skilled Care, LLC dba Cornerstone Care Center notified patients that an unauthorized party may have accessed protected health information after a compromised employee account was discovered in April 2026.
Cornerstone Care Center Data Breach Exposes Protected Health Information Read More »
The Phia Group, a healthcare cost containment firm, discovered a data security incident in July 2024 that may have exposed personal information belonging to health plan participants.
The Phia Group Data Breach Exposes Personal and Health Plan Information Read More »
A vendor breach at Lumexa Imaging exposed patients’ names, Social Security numbers, insurance details, and radiology-related health information after an unauthorized party accessed vendor systems in early 2026.
Lumexa Imaging Data Breach Exposes Social Security Numbers and Health Records Read More »