Healthcare data breaches expose some of the most sensitive personal information that exists: medical records, Social Security numbers, insurance details, diagnosis and treatment history, and sometimes genetic or mental health information. These exposures can lead to medical identity theft, insurance fraud committed in a patient’s name, and the unwanted disclosure of private health conditions that can affect employment, relationships, or insurability. Hospitals, clinics, health insurers, and healthcare technology vendors are among the most frequently targeted organizations for ransomware and data theft, in part because medical records are especially valuable on illicit markets and healthcare providers often operate complex, interconnected IT systems. A single breach at a hospital system, health plan, or medical billing vendor can affect hundreds of thousands of patients at once. This page tracks confirmed data breaches at hospitals, clinics, insurers, and other healthcare organizations, including what data was exposed, which companies notified the HHS Office for Civil Rights and other regulators, and what affected patients can do next to protect their medical and financial identity.
Nacogdoches Memorial Hospital discovered on January 31, 2026 that hackers had breached its network, potentially exposing patients' names, addresses, phone numbers, emails, Social Security numbers, dates of birth, medical record and account numbers, health plan beneficiary numbers, and photographs. Anyone notified should immediately place a fraud alert or credit freeze with the major credit bureaus
Bay Area Community Health notified patients that an unauthorized individual accessed systems belonging to TriZetto, a vendor connected to its OCHIN electronic medical record platform, on December 15, 2025. Exposed data may include names, Social Security numbers, dates of birth, contact details, and health/insurance information. Not all patients were affected. Affected individuals should enroll in
Bay Area Community Health Data Breach Notice: What Patients Need to Know Read More »
Sierra Vista Health System discovered that hackers accessed its network between January 14 and January 31, 2025, potentially removing patients' and employees' names, addresses, birth dates, Social Security numbers, medical records, and health insurance information. Confirmed in August 2025, this breach affects anyone connected to the organization. Affected individuals should immediately monitor their credit reports
In December 2024 and June 2025, Sturgis Hospital experienced a data breach that may have exposed patient and employee information, including Social Security numbers, bank details, and medical records. Learn what happened, what information was involved, steps the company is taking, and how you can protect yourself—including when to contact a data breach attorney for legal help.
Wayne Memorial Hospital Cybersecurity Incident Notice
Wayne Memorial Hospital (WMH) recently experienced a ransomware incident that impacted a limited number of our systems between May 30, 2024, and June 3, 2024. Upon discovery, we immediately secured our network, restored operations from backups, and engaged independent cybersecurity experts to investigate.
The review determined that certain patient information may have been accessed without authorization. While not every individual was affected, the data at risk may include names, Social Security numbers, medical records, insurance details, and other personal information.
On August 27, 2025, WMH mailed written notices to all affected individuals and provided guidance on how to protect their personal information. Data security remains one of our highest priorities, and we have implemented enhanced safeguards to prevent future incidents.
Highlands Oncology Group discovered a cyberattack on June 2, 2025, exposing sensitive patient data including Social Security numbers, medical records, and financial information. The breach affected systems between January and June 2025. Highlands is offering free 12-month credit monitoring through Experian to those impacted. Learn how to protect your identity and enroll in complimentary protection services.
Highlands Oncology Data Breach Exposes Sensitive Patient Information Read More »
McKenzie, a healthcare company, suffered a data breach after an unauthorized actor accessed its network between April 14 and 15, 2025, potentially exposing full names, Social Security numbers, and financial account information. Affected individuals were notified by letter starting July 24, 2025. Anyone who received a notification should immediately enroll in the free identity protection
McKenzie Data Breach Exposes Sensitive Information Read More »
Myrtue Medical Center detected unusual network activity on June 13, 2025, later found to involve unauthorized access to sensitive files containing patients' names, driver's license numbers, identification numbers, Social Security numbers, and direct deposit information. Anyone whose data was handled by the medical center could be affected. Impacted individuals should place a fraud alert or
On September 15, 2024, Western Montana Mental Health Center (WMMHC) discovered a data breach exposing sensitive personal and health information. Impacted individuals are urged to enroll in complimentary identity protection services through IDX by October 17, 2025. Learn what happened, what information was involved, and how to protect yourself from potential identity theft.
Western Montana Mental Health Center Data Breach Exposes Sensitive Patient Information Read More »
Community Health Network has confirmed a data breach affecting patients across Indiana. Sensitive information—including Social Security numbers, medical records, and insurance details—may have been exposed. Learn what happened, who’s at risk, and what urgent steps you should take to protect your identity. Legal options may also be available for those affected.
Community Health Network Data Breach: What Indiana Residents Need to Know and Do Now Read More »