Healthcare data breaches expose some of the most sensitive personal information that exists: medical records, Social Security numbers, insurance details, diagnosis and treatment history, and sometimes genetic or mental health information. These exposures can lead to medical identity theft, insurance fraud committed in a patient’s name, and the unwanted disclosure of private health conditions that can affect employment, relationships, or insurability. Hospitals, clinics, health insurers, and healthcare technology vendors are among the most frequently targeted organizations for ransomware and data theft, in part because medical records are especially valuable on illicit markets and healthcare providers often operate complex, interconnected IT systems. A single breach at a hospital system, health plan, or medical billing vendor can affect hundreds of thousands of patients at once. This page tracks confirmed data breaches at hospitals, clinics, insurers, and other healthcare organizations, including what data was exposed, which companies notified the HHS Office for Civil Rights and other regulators, and what affected patients can do next to protect their medical and financial identity.
Iroquois Memorial Hospital notified regulators that a data breach exposed patient Social Security numbers and health records, raising the risk of identity theft and medical fraud.
Magnolia Medical Clinic PA notified federal regulators that paper health records for 1,601 patients were subject to unauthorized access or disclosure. Here is what affected patients need to know.
Magnolia Medical Clinic PA Data Breach Exposes Patient Health Records in Paper Files Read More »
Rockwood Retirement Communities, also known as Spokane United Methodist Homes, notified Washington regulators of a data breach that may have exposed sensitive resident and employee information.
Kaniksu Community Health notified regulators that a data breach compromised patients’ Social Security numbers and health records, prompting warnings about identity theft and medical fraud risks.
Kaniksu Community Health Data Breach Exposes Social Security Numbers and Health Records Read More »
Baraga County Memorial Hospital notified federal regulators that a hacking incident on its network server exposed the personal health information of 501 patients.
Baraga County Memorial Hospital Data Breach Exposes Patient Health Information Read More »
Two ransomware groups have claimed separate attacks on Interim HealthCare, alleging theft of medical records, patient lists, and internal business data from the nationwide home healthcare provider.
Interim HealthCare Data Breach Exposes Medical Records and Personal Patient Data Read More »
Elixir Medical Corporation notified current and former employees, consultants, and their dependents that an unauthorized party accessed sensitive personal and health information during a July 2026 network intrusion.
A ShinyHunters extortion campaign led to the public leak of health records, emails, and contact information tied to millions of Exact Sciences customers, patients, and providers.
Exact Sciences Data Breach Exposes Personal Health Records and Contact Information Read More »
Orthopedics & Sports Medicine Owensboro, P.S.C., doing business as Advanced Center for Orthopedics & Sports Medicine, has disclosed a data breach that exposed patients’ Social Security numbers and health records.
Alcon, the global eye care company, was named in a ShinyHunters extortion campaign that published data allegedly stolen from the company, including 218,000 unique email addresses and other contact details.
Alcon Data Breach Exposes Names, Emails, and Phone Numbers Read More »