Healthcare data breaches expose some of the most sensitive personal information that exists: medical records, Social Security numbers, insurance details, diagnosis and treatment history, and sometimes genetic or mental health information. These exposures can lead to medical identity theft, insurance fraud committed in a patient’s name, and the unwanted disclosure of private health conditions that can affect employment, relationships, or insurability. Hospitals, clinics, health insurers, and healthcare technology vendors are among the most frequently targeted organizations for ransomware and data theft, in part because medical records are especially valuable on illicit markets and healthcare providers often operate complex, interconnected IT systems. A single breach at a hospital system, health plan, or medical billing vendor can affect hundreds of thousands of patients at once. This page tracks confirmed data breaches at hospitals, clinics, insurers, and other healthcare organizations, including what data was exposed, which companies notified the HHS Office for Civil Rights and other regulators, and what affected patients can do next to protect their medical and financial identity.
A ransomware group called PEAR claims to have stolen roughly 1.4 TB of data from South Plains Rural Health Services, a nonprofit healthcare provider serving rural West Texas communities.
McKesson disclosed a cybersecurity incident after the ShinyHunters extortion group claimed it stole hundreds of millions of patient data records from the healthcare distributor’s systems.
McKesson Data Breach Exposes Social Security Numbers and Patient Medical Records Read More »
Diana Health, Inc. notified the Vermont Attorney General that a data breach compromised Social Security numbers, prompting concern among patients and staff about identity theft risk.
Diana Health, Inc. Data Breach Exposes Social Security Numbers Read More »
Healthfirst Bluegrass, Inc. notified regulators that a data breach exposed patients’ Social Security numbers and health records, prompting fresh concerns about identity theft and medical fraud.
Murfreesboro Medical Clinic notified regulators that patient Social Security numbers and health records were exposed in a data breach, prompting concerns about identity theft and medical fraud.
Together Women’s Health LLC notified patients that a data breach handled through its vendor Aesto LLC exposed sensitive personal and medical information, prompting formal notice to California regulators.
Together Women’s Health LLC Data Breach Exposes Medical and Personal Information Read More »
ShinyHunters claims to have stolen and leaked roughly 7.1 million records tied to Baxter International after breaching third-party Salesforce applications connected to the medical device maker.
Baxter International Data Breach Exposes Personal Information in Salesforce Records Read More »
SpineZone (Livara Health Medical Group) has notified patients that a security incident at its data vendor Aesto exposed protected health information between December 2 and December 18, 2025.
A ransomware group known as direwolf claimed responsibility for a cyberattack on the National Kidney Registry, raising concerns about the exposure of sensitive donor and patient health information.
National Kidney Registry Data Breach Exposes Patient and Donor Health Information Read More »
Nutex Health, a for-profit hospital operator running 28 facilities across 12 states, has confirmed that an unauthorized third party accessed and stole data from its servers.
Nutex Health Data Breach Exposes Patient and Employee Information Read More »