Healthcare data breaches expose some of the most sensitive personal information that exists: medical records, Social Security numbers, insurance details, diagnosis and treatment history, and sometimes genetic or mental health information. These exposures can lead to medical identity theft, insurance fraud committed in a patient’s name, and the unwanted disclosure of private health conditions that can affect employment, relationships, or insurability. Hospitals, clinics, health insurers, and healthcare technology vendors are among the most frequently targeted organizations for ransomware and data theft, in part because medical records are especially valuable on illicit markets and healthcare providers often operate complex, interconnected IT systems. A single breach at a hospital system, health plan, or medical billing vendor can affect hundreds of thousands of patients at once. This page tracks confirmed data breaches at hospitals, clinics, insurers, and other healthcare organizations, including what data was exposed, which companies notified the HHS Office for Civil Rights and other regulators, and what affected patients can do next to protect their medical and financial identity.
North Los Angeles County Regional Center is notifying individuals that a November 2024 ransomware attack led to the theft of Social Security numbers, medical records, and other sensitive personal data.
Midland Care Connection, a Kansas nonprofit healthcare organization, disclosed that hackers accessed and copied sensitive files including Social Security numbers, medical records, and financial account information.
Midland Care Connection Data Breach Exposes Social Security Numbers and Medical Records Read More »
A Michigan dental practice, Erick K. Perroud, D.D.S., P.C., disclosed a data incident affecting 7,692 individuals through a state Attorney General filing, though full details remain limited.
Erick K. Perroud DDS Data Breach Exposes Patient Personal Information Read More »
A ransomware attack on North Los Angeles County Regional Center exposed Social Security numbers, financial data and detailed medical records belonging to nearly 300,000 people nationwide.
NLACRC Data Breach Exposes Social Security Numbers and Medical Records Read More »
Optalis Management Solutions, an Ohio-based healthcare organization, has notified individuals that a network intrusion in April 2025 may have exposed Social Security numbers, financial information, and medical records.
Serviceaide, a vendor for Catholic Health, agreed to pay $1.8 million to settle lawsuits over a 2024 data breach that exposed the personal and medical data of roughly 483,000 patients.
Serviceaide Data Breach Exposes Social Security Numbers and Medical Records Read More »
Greater Rochester Independent Practice Association has agreed to a $2.15 million settlement after the 2023 MOVEit data breach exposed patients’ Social Security numbers, health records, and prescription information.
Phoenix Environmental Laboratories, a Connecticut laboratory company, appeared on Vermont’s official breach notice list after names, Social Security numbers, and medical record numbers were reportedly involved in a security incident.
Glucobit Inc., doing business as Reframe, reported a hacking incident that exposed the names and health records of 43,902 people, according to a state attorney general filing.
Reframe Data Breach Exposes Names and Health Records Read More »
AdaptHealth Corp, a Pennsylvania healthcare company, disclosed a hacking incident that may have exposed patient names, health records, and health insurance information.
AdaptHealth Data Breach Exposes Names, Health Records, and Insurance Information Read More »