Healthcare data breaches expose some of the most sensitive personal information that exists: medical records, Social Security numbers, insurance details, diagnosis and treatment history, and sometimes genetic or mental health information. These exposures can lead to medical identity theft, insurance fraud committed in a patient’s name, and the unwanted disclosure of private health conditions that can affect employment, relationships, or insurability. Hospitals, clinics, health insurers, and healthcare technology vendors are among the most frequently targeted organizations for ransomware and data theft, in part because medical records are especially valuable on illicit markets and healthcare providers often operate complex, interconnected IT systems. A single breach at a hospital system, health plan, or medical billing vendor can affect hundreds of thousands of patients at once. This page tracks confirmed data breaches at hospitals, clinics, insurers, and other healthcare organizations, including what data was exposed, which companies notified the HHS Office for Civil Rights and other regulators, and what affected patients can do next to protect their medical and financial identity.
The Devereux Foundation, a national behavioral healthcare nonprofit, confirmed a data breach after a ransomware group claimed to have stolen sensitive clinical, financial and personal information belonging to clients, employees, donors and partners.
The Devereux Foundation Data Breach Exposes Clinical and Financial Information Read More »
Woundtech, formally Wound Technology Network Inc., disclosed a data breach that exposed Social Security numbers, clinical notes and medical images belonging to 139,830 individuals after a threat actor claimed to have stolen terabytes of patient data.
Woundtech Data Breach Exposes Social Security Numbers and Medical Records Read More »
A vendor breach at TriZetto Provider Solutions exposed the names, Social Security numbers, and health information of Share Ourselves patients between November 2024 and October 2025.
Share Ourselves Data Breach Exposes Social Security Numbers and Health Records Read More »
Intuitive Surgical disclosed that a targeted phishing attack let an unauthorized third party access internal business systems, exposing customer and employee contact and corporate data.
Intuitive Surgical Data Breach Exposes Customer and Employee Contact Data Read More »
Parexel International disclosed that a zero-day flaw in Oracle’s cloud infrastructure led to unauthorized access to employment records containing Social Security numbers, financial account details and other sensitive personal data.
Parexel Data Breach Exposes Social Security Numbers and Financial Information Read More »
St. James Place of Baton Rouge disclosed that a 2024 ransomware attack exposed residents’ and employees’ Social Security numbers, financial data and protected health information.
St. James Place Data Breach Exposes Social Security Numbers and Health Records Read More »
Longevity Health Plan disclosed a data breach affecting roughly 15,000 people, involving protected health information belonging to Medicare plan members in long-term care facilities.
Longevity Health Plan Data Breach Exposes Protected Health Information Read More »
Nassau OOGP Vision Group notified customers and state regulators that an unauthorized third party accessed its systems and acquired files containing names, addresses, and prescription and medical information tied to contact lens orders.
Nassau OOGP Vision Group Data Breach Exposes Medical and Prescription Information Read More »
A third-party vendor breach at TriZetto, which supports Native American Health Center’s billing systems, exposed patients’ Social Security numbers, health records and other sensitive data.
EyeCare Partners has notified over 17,600 individuals that their personal and health information was exposed after an unauthorized third party accessed employee email accounts for nearly two months.
EyeCare Partners Data Breach Exposes Social Security Numbers and Health Information Read More »