Healthcare data breaches expose some of the most sensitive personal information that exists: medical records, Social Security numbers, insurance details, diagnosis and treatment history, and sometimes genetic or mental health information. These exposures can lead to medical identity theft, insurance fraud committed in a patient’s name, and the unwanted disclosure of private health conditions that can affect employment, relationships, or insurability. Hospitals, clinics, health insurers, and healthcare technology vendors are among the most frequently targeted organizations for ransomware and data theft, in part because medical records are especially valuable on illicit markets and healthcare providers often operate complex, interconnected IT systems. A single breach at a hospital system, health plan, or medical billing vendor can affect hundreds of thousands of patients at once. This page tracks confirmed data breaches at hospitals, clinics, insurers, and other healthcare organizations, including what data was exposed, which companies notified the HHS Office for Civil Rights and other regulators, and what affected patients can do next to protect their medical and financial identity.
A phishing attack against Integrated Oncology Network, which manages Rocky Mountain Oncology Care, allowed hackers to access email and SharePoint accounts between December 13-16, 2024, exposing patients' names, dates of birth, Social Security numbers, medical records, and financial information. Anyone treated at the facility may be affected. Affected patients should immediately place a fraud alert
Arbor Associates, a healthcare staffing and services company, detected unauthorized network access between April 15 and April 17, 2025, that exposed patients' names, contact details, birth dates, medical service dates, diagnosis codes, medical record numbers, and insurance and provider information. Affected individuals should first carefully review medical insurance statements and explanation of benefits documents for
Find out what happened in the Radiology Associates of Richmond data breach. Learn what information was exposed and your legal rights.
Health Care and Rehabilitation Services of Southeastern Vermont (HCRS) experienced a data breach in December 2024 that exposed sensitive personal and medical information of clients and staff. The incident involved unauthorized access to employee email accounts and was confirmed in May 2025. Learn what happened, what data was compromised, and how to protect yourself from identity theft.