Healthcare data breaches expose some of the most sensitive personal information that exists: medical records, Social Security numbers, insurance details, diagnosis and treatment history, and sometimes genetic or mental health information. These exposures can lead to medical identity theft, insurance fraud committed in a patient’s name, and the unwanted disclosure of private health conditions that can affect employment, relationships, or insurability. Hospitals, clinics, health insurers, and healthcare technology vendors are among the most frequently targeted organizations for ransomware and data theft, in part because medical records are especially valuable on illicit markets and healthcare providers often operate complex, interconnected IT systems. A single breach at a hospital system, health plan, or medical billing vendor can affect hundreds of thousands of patients at once. This page tracks confirmed data breaches at hospitals, clinics, insurers, and other healthcare organizations, including what data was exposed, which companies notified the HHS Office for Civil Rights and other regulators, and what affected patients can do next to protect their medical and financial identity.
A ransomware attack on the Texas Hearing Institute exposed the names, Social Security numbers, financial information, and medical records of nearly 30,000 Texas residents.
Texas Hearing Institute Data Breach Exposes Social Security Numbers and Medical Records Read More »
Members of the hacking group pleaded guilty to conspiracy charges tied to cyberattacks on U.S. healthcare providers SSM Health Care and Sutter Health, raising fresh concerns about patient data security.
SSM Health Care and Sutter Health Data Breach Exposes Patient Records Read More »
Virta Health discovered that an unauthorized party accessed a data repository containing historical patient records over a three-day period in March 2026, exposing names, Social Security or ITIN numbers, birth dates, contact details, and extensive medical and insurance information. Anyone notified by Virta Health should immediately enroll in the free credit monitoring offered and closely
Virta Health Data Breach 2026: Sensitive Medical and Personal Information Exposed Read More »
CenterWell, a Humana-owned healthcare provider, discovered a data breach in June 2026 in which hackers gained unauthorized access to patient records containing personal, medical, and financial account information. Roughly 9,651 people nationwide are affected, including at least 4,618 Texas residents. Anyone notified should immediately review financial and insurance statements for suspicious activity and enroll in
CenterWell Data Breach Exposes Medical and Financial Information of 9,651 Patients Read More »
C2N Diagnostics discovered on March 6, 2026, that hackers gained unauthorized access to several employees' email accounts, exposing patients' names, birth dates, contact details, Social Security numbers, health insurance information, and blood test results. Roughly 2,027 people nationwide were affected. Anyone notified should immediately read the letter carefully to learn exactly what data was exposed,
Nottingham Village, a senior living and healthcare provider, confirmed a data breach involving unauthorized access to its systems, disclosed via an attorney general filing on May 22, 2026. Between 1,000 and 10,000 individuals may be affected, potentially including residents' personal, medical, and financial information. Specific exposed data remains undisclosed. Affected individuals should first monitor financial
Glendora Surgery Center discovered suspicious activity on its systems and, following a forensic investigation, determined that unauthorized parties may have accessed files containing patients' names, dates of birth, Social Security numbers, medical and health insurance information, and government-issued ID details. Affected patients and individuals in its systems should first carefully read their notification letter to
Spokane Digestive Disease Center suffered a hacking or IT security incident involving its email systems, which may have exposed patient names, medical records, insurance details, or Social Security numbers, though the exact scope remains undisclosed. Patients and anyone who received care there could be affected. Those concerned should closely monitor medical statements, insurance notices, and
Spokane Digestive Disease Center Cyberattack Raises Patient Data Concerns Read More »
Verber Dental discovered unauthorized access to its network between January 26 and 27, 2026, potentially exposing patients' full names, Social Security numbers, dates of birth, medical records, and health insurance information. Affected individuals should act immediately by placing a fraud alert or credit freeze with the major credit bureaus to reduce the risk of identity
Champion Healthcare discovered in late January 2026 that an unauthorized party had accessed its internal corporate systems and obtained sensitive files containing Social Security numbers, medical information, passport details, and other government-issued ID data. Patients and employees whose records were compromised may be at heightened risk of identity theft and phishing. Affected individuals should first