Healthcare data breaches expose some of the most sensitive personal information that exists: medical records, Social Security numbers, insurance details, diagnosis and treatment history, and sometimes genetic or mental health information. These exposures can lead to medical identity theft, insurance fraud committed in a patient’s name, and the unwanted disclosure of private health conditions that can affect employment, relationships, or insurability. Hospitals, clinics, health insurers, and healthcare technology vendors are among the most frequently targeted organizations for ransomware and data theft, in part because medical records are especially valuable on illicit markets and healthcare providers often operate complex, interconnected IT systems. A single breach at a hospital system, health plan, or medical billing vendor can affect hundreds of thousands of patients at once. This page tracks confirmed data breaches at hospitals, clinics, insurers, and other healthcare organizations, including what data was exposed, which companies notified the HHS Office for Civil Rights and other regulators, and what affected patients can do next to protect their medical and financial identity.
Averhealth Holdings notified the Vermont Attorney General of a data breach involving health records, prompting concerns about medical privacy and identity theft for affected individuals.
Averhealth Holdings Data Breach Exposes Health Records Read More »
Mission Pet Health suffered a ransomware attack attributed to the direwolf threat actor group, raising concerns that client and patient personal information was accessed without authorization.
Mission Pet Health Data Breach Exposes Patient and Client Personal Information Read More »
Veradigm Inc. suffered a ransomware attack in which a threat actor group claimed to have stolen more than 3.5 million patient records, including Social Security numbers and contact details.
Veradigm Inc. Data Breach Exposes Social Security Numbers and Patient Records Read More »
AnMed Health notified federal regulators of a hacking incident that compromised the network server holding patient information for 501 individuals.
AnMed Health Data Breach Exposes Patient Health and Personal Information Read More »
Mountain Rheumatology Professional, LLC notified federal regulators that a network server hacking incident exposed personal and health information belonging to 5,378 individuals.
Integrative Emergency Services, LLC notified federal regulators that a hacking incident involving an email account exposed the health information of 2,009 individuals.
Integrative Emergency Services, LLC Data Breach Exposes Patient Health Information Read More »
Novocure, a global oncology company, has confirmed a cyberattack that exposed the records of more than 1,400 U.S. cancer patients along with employee contact information.
Novocure Data Breach Exposes Cancer Patient Records and Employee Contact Information Read More »
A ransomware group called PEAR claims to have stolen roughly 1.4 TB of data from South Plains Rural Health Services, a nonprofit healthcare provider serving rural West Texas communities.
McKesson disclosed a cybersecurity incident after the ShinyHunters extortion group claimed it stole hundreds of millions of patient data records from the healthcare distributor’s systems.
McKesson Data Breach Exposes Social Security Numbers and Patient Medical Records Read More »
Diana Health, Inc. notified the Vermont Attorney General that a data breach compromised Social Security numbers, prompting concern among patients and staff about identity theft risk.
Diana Health, Inc. Data Breach Exposes Social Security Numbers Read More »